CVE-2026-124486

Summary

OpenEMR before 8.3.0 lacks proper authorization checks in its classic document controller, allowing low-privilege authenticated users to move other patients' documents into their own category and retrieve them without specifying a patient ID, leading to unauthorized access and modification of protected health information (PHI).

Exploitability

Exploitation requires only low-privilege authentication and knowledge of the vulnerable endpoint (move_action_process), with no complex conditions or bypasses needed.

Blast radius

Successful exploitation enables any authenticated low-privilege user to exfiltrate, alter, or delete PHI for arbitrary patients, potentially affecting all records in the system and violating HIPAA compliance.

Detection

Defenders should monitor server logs for requests to /interface/documents/move_action_process with an empty patient_id parameter or unexpected category changes (e.g., patients|demo) initiated by users lacking elevated permissions; such anomalies may indicate attempted exploitation.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which includes the official fix for this missing authorization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.