High severity8.8NVD Advisory· Published Nov 8, 2026

CVE-2026-124484

Description

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.

Affected products

Openemr/Openemrllm-fuzzy
Range: <8.4.0

Patches

Vulnerability mechanics

References

github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpgnvd
www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-in-portal-onsite-document-apisnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000