High priorityDisclosed

Advisory · CVE-2026-124486

OpenEMR document controller lets low-privilege users move and read any patient's files

OpenEMR before 8.3.0 contains a missing authorization flaw in the classic document controller that lets low-privilege authenticated users recategorize other patients' documents, invoking move_action_process to move a document into a patients demo category, then retrieving it with an empty patient_id to exfiltrate PHI and tamper with charts, rated high at CVSS 8.8; fixed in 8.3.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124486
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's document cabinet lets any logged-in user move a file into a shared drawer and then open that drawer with no patient attached. A low-privilege user can move another patient's documents into the open and read them.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Low-privilege login

    An authenticated low-privilege user logs in.

  2. 02Document recategorized

    move_action_process moves another patient's document into a patients demo category.

  3. 03Empty patient_id used

    The document is retrieved with an empty patient_id.

  4. 04PHI exfiltrated

    The document content is read across patients.

  5. 05Charts tampered

    Documents are moved or altered, changing clinical charts.

What happened

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients’ documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

Moving a document out of its patient’s folder is enough to break the access model, and the empty patient_id retrieval makes it trivial. The flaw is fixed in OpenEMR 8.3.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.3.0 or later.
  3. Review document controller logs for move_action_process calls.
  4. Audit documents in shared categories for misplaced patient files.
  5. Notify affected patients if cross-patient access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Documents that moved categories may still be sitting in the wrong place. Check the shared drawers, not just the version.