CVE-2026-124484

Summary

OpenEMR before 8.4.0 lacks authorization checks on its portal onsite-document APIs, allowing any authenticated core user to access, read, list, and overwrite other patients' documents by omitting the patientId parameter and specifying arbitrary record IDs. This violates patient data isolation and enables unauthorized modification of sensitive medical records.

Exploitability

Exploitation requires only valid authentication as a core user with portal access; no special privileges or technical sophistication beyond API interaction is needed.

Blast radius

A successful exploit could enable full read/write access to any patient's portal documents, signatures, and templates within the system, compromising confidentiality, integrity, and availability of protected health information across the entire patient population.

Detection

Defenders should monitor server logs for API requests to /portal/onsite-document endpoints where the patientId parameter is missing or inconsistent with the authenticated user's assigned patients, especially when combined with non-null recordId values referencing other patients' records.

Prioritized remediation

Upgrade to OpenEMR version 8.4.0 or later, which includes the required authorization enforcement for the affected portal onsite-document APIs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.