High priorityDisclosed

Advisory · CVE-2026-124471

OpenEMR billing pages let any user read and change any encounter's bills

OpenEMR before 8.3.0 contains a missing authorization flaw in interface/billing/sl_eob_invoice.php that lets any authenticated user read and modify billing data for any encounter, iterating the id parameter to read patient names and billing notes and post payments, adjustments, deletions, or billing notes against any patient's account, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124471
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's billing page takes an encounter number and never checks whether it belongs to you. Any logged-in user can walk through the numbers, read anyone's bills, and post payments or deletions against any patient's account.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Authenticated login

    Any authenticated user logs in.

  2. 02Encounter id iterated

    The id parameter is walked through encounter numbers.

  3. 03Authorization missing

    sl_eob_invoice.php performs no ownership check.

  4. 04Billing data read

    Patient names and billing notes are disclosed.

  5. 05Billing changed

    Payments, adjustments, deletions, and notes are posted against other patients' accounts.

What happened

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient’s account. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.

Billing data is financial and clinical at once, and this flaw lets any account rewrite it for any patient. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review billing logs for id enumeration and cross-patient changes.
  4. Audit billing records for payments, adjustments, or deletions that do not match the treating staff.
  5. Reconcile billing data and notify affected patients if tampering cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Billing tampering is fraud-shaped, not just a privacy issue. Reconcile the billing records before assuming nothing was changed.