High priorityDisclosed

Advisory · CVE-2026-124461

OpenEMR document uploads can be read and overwritten across all patients

OpenEMR before 8.3.0 contains a missing authorization flaw in library/ajax/upload.php that lets any authenticated user read and overwrite document data by supplying an arbitrary doc_id, enumerating doc_id values with fetch and save actions to disclose patient health information and tamper with medical records across all patients, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124461
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's document upload page takes a document number and never asks whether that document belongs to you. Any logged-in user can try numbers in order and pull up or overwrite any patient's files.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Authenticated login

    Any authenticated user logs in.

  2. 02doc_id enumerated

    doc_id values are tried with the fetch and save actions.

  3. 03Authorization missing

    library/ajax/upload.php performs no ownership check.

  4. 04Documents disclosed

    Patient health information is read across all patients.

  5. 05Records tampered

    Document data is overwritten, altering medical records.

What happened

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fetch and save actions to disclose patient health information and tamper with medical records across all patients. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.

A document endpoint with no authorization check is an open file cabinet for the whole patient population. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review upload.php logs for doc_id enumeration.
  4. Audit documents for reads and writes that do not match the owning patient.
  5. Notify affected patients if cross-patient access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Every patient’s documents were one guessed number away. Check the access logs before assuming the exposure stayed theoretical.