CVE-2026-124477

Summary

OpenEMR versions before 8.3.0 lack authorization checks on the delete_Recall action, allowing low-privileged authenticated users to delete arbitrary patient recall records by sending a POST request to /interface/main/messages/save.php with target parameters. This violates the principle of least privilege and enables data destruction without proper access controls.

Exploitability

Exploitation is straightforward for authenticated low-privileged users (e.g., clinic staff) as it requires only sending a standard POST request with predictable parameters (pid, r_ID) to a publicly accessible endpoint.

Blast radius

Successful exploitation enables unauthorized deletion of critical clinical recall data, potentially compromising patient safety, disrupting care workflows, and violating HIPAA data integrity requirements.

Detection

Defenders should monitor server access logs for POST requests to /interface/main/messages/save.php containing r_ID and pid parameters, especially when issued by users without clinical or administrative privileges; anomalous bulk deletions of recall records in audit logs may also indicate exploitation.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which includes the missing authorization fix for the delete_Recall action.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.