High priorityDisclosed

Advisory · CVE-2026-124477

OpenEMR lets low-privilege users delete any patient's recall records

OpenEMR before 8.3.0 contains a missing authorization flaw that lets low-privileged authenticated users delete arbitrary patient recall records via the delete_Recall action, sending POST requests to interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks, rated high at CVSS 8.8; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124477
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR keeps recall records that remind clinics to bring patients back for care. The delete button for those records never checks who you are, so any logged-in user can erase any patient's recalls.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Low-privilege login

    An authenticated low-privilege user logs in.

  2. 02Recall targeted

    A target patient id and recall id are chosen.

  3. 03Delete posted

    A POST to interface/main/messages/save.php carries the delete_Recall action.

  4. 04No check performed

    No ACL or ownership check runs on the request.

  5. 05Recall removed

    The patient's recall data is deleted.

What happened

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

Deleting recall data is deleting a clinical safety net, and any account could do it to any patient. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review message save logs for delete_Recall actions.
  4. Audit recall records for deletions that do not match the treating staff.
  5. Restore deleted recalls from backups where possible and notify affected patients.
  6. Verify the deployed version after updating.

Management note

Deleted recalls mean missed follow-ups, which is a patient safety issue, not just a data issue. Restore what was deleted before moving on.