High priorityDisclosed

Advisory · CVE-2026-124484

OpenEMR patient portal documents are open to any authenticated user

OpenEMR before 8.4.0 contains a missing authorization flaw in portal onsite-document APIs that lets any authenticated core user access cross-patient documents, omitting the patientId parameter and supplying arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data, rated high at CVSS 8.8; fixed in 8.4.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124484
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's portal document pages take a record number and never check whose patient it belongs to. Any logged-in user can leave the patient field blank, try other numbers, and read or overwrite anyone's portal documents and signatures.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Core user login

    Any authenticated core user logs in.

  2. 02patientId omitted

    The request leaves out the patientId parameter.

  3. 03Record IDs supplied

    Arbitrary record IDs are passed to the onsite-document APIs.

  4. 04Authorization missing

    No ownership check runs on the request.

  5. 05Documents accessed

    Other patients' portal documents, signatures, and template data are listed, read, and overwritten.

What happened

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients’ portal documents, signatures, and template data. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

Portal documents include signatures and consent-related material, so cross-patient access here touches legal records, not just notes. The flaw is fixed in OpenEMR 8.4.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.4.0 or later.
  3. Review onsite-document API logs for requests without patientId or with mismatched record IDs.
  4. Audit portal documents and signatures for cross-patient access.
  5. Notify affected patients if access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Signatures and consent documents are legal records. Check who touched them before treating this as a routine patch.