Advisory · CVE-2026-124472
OpenEMR patient billing notes are open to any authenticated user
OpenEMR before 8.3.0 contains a missing authorization flaw in interface/billing/sl_eob_patient_note.php that lets any authenticated user read and modify patient billing notes, enumerating the patient_id parameter and submitting POST requests using the embedded CSRF token to view or tamper with confidential billing data, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124472
CWE-862 - Action timing
- Immediate
Explain it like I’m five
OpenEMR's patient billing notes page takes a patient number and never checks it. Any logged-in user can walk the numbers and read or rewrite anyone's confidential billing notes.
- 01Authenticated login
An attacker logs in with a low-privilege account.
- 02patient_id enumerated
The patient_id parameter is walked through patient numbers.
- 03Authorization missing
sl_eob_patient_note.php performs no ownership check.
- 04Notes disclosed
Confidential billing data is viewed.
- 05Notes tampered
POST requests rewrite the billing notes.
What happened
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.
A second billing endpoint with the same missing check in the same release, so the same audit applies twice. The flaw is fixed in OpenEMR 8.3.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.3.0 or later.
- Review billing note logs for patient_id enumeration.
- Audit patient billing notes for edits that do not match the treating staff.
- Reconcile billing data and notify affected patients if tampering cannot be excluded.
- Verify the deployed version after updating.
Management note
Two billing endpoints, same missing check. Audit both sets of records before closing the incident.