High priorityDisclosed

Advisory · CVE-2026-124447

OpenEMR portal patients can take over other patients' activity records

OpenEMR before 8.3.0 contains an insecure direct object reference in OnsitePortalActivityController Update, which checks the request's patientId instead of the stored record's owner, letting authenticated portal patients send PUT requests with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124447
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's patient portal is supposed to check that a record belongs to you before letting you change it. It checks the name on the request instead of the name on the record, so a patient can edit someone else's activity by putting their own name on the form.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Portal login

    An authenticated portal patient logs in.

  2. 02Another patient's activity id

    The attacker picks an activity record belonging to another patient.

  3. 03Own patientId supplied

    The PUT request carries the attacker's own patientId.

  4. 04Check passes

    The controller checks the request's patientId instead of the record's owner.

  5. 05Record taken over

    Narratives and status are overwritten and ownership of the record transfers.

What happened

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request’s patientId instead of the stored record’s owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient’s activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.

An ownership check that trusts the request instead of the record is no check at all, and the result is cross-patient record tampering. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review portal activity logs for PUT requests with mismatched patient ids.
  4. Audit onsite activity records for ownership changes and narrative edits.
  5. Notify affected patients if cross-patient access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Patients editing each other’s records is a privacy failure with clinical consequences. Audit the activity records, not just the version number.