Advisory · CVE-2026-124459
OpenEMR encounter forms can be read and overwritten across patients
OpenEMR before 8.3.0 contains an insecure direct object reference in many encounter-form view and save endpoints that lack patient and encounter ownership checks, letting authenticated clinical users enumerate sequential form id values to read and overwrite other patients' clinical records, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124459
CWE-639 - Action timing
- Immediate
Explain it like I’m five
OpenEMR's encounter forms are numbered in order, and the pages that show and save them never check whose patient the form belongs to. A logged-in user can just try the next number and read or rewrite another patient's clinical notes.
- 01Clinical login
An authenticated clinical user logs in.
- 02Form id enumerated
Sequential form id values are tried in view and save requests such as soap/view.php and save.php.
- 03Ownership unchecked
The endpoints skip patient and encounter ownership checks.
- 04Records read and written
Other patients' clinical records are disclosed and overwritten.
What happened
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients’ clinical records. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.
Sequential ids plus missing ownership checks make cross-patient access trivial to automate. The flaw is fixed in OpenEMR 8.3.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.3.0 or later.
- Review encounter-form access logs for sequential id enumeration.
- Audit clinical records for edits that do not match the treating clinician.
- Notify affected patients if cross-patient access cannot be excluded.
- Verify the deployed version after updating.
Management note
Clinical notes are the most sensitive records in the system, and this flaw lets any clinical user rewrite anyone’s. Audit the notes, not just the version.