Advisory · CVE-2026-124488
OpenEMR clinicians without high-sensitivity access can read restricted encounter forms
OpenEMR before 8.3.0 contains an authorization bypass that lets authenticated clinicians lacking high-sensitivity permission read and modify encounter-bound forms via load_form.php, requesting the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submitting save.php to tamper with clinical records, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124488
CWE-862 - Action timing
- Immediate
Explain it like I’m five
Some OpenEMR encounter forms are marked high-sensitivity and need a special permission. A flaw in the form loader lets a clinician without that permission open those forms anyway, read the restricted content, and save changes to it.
- 01Clinician login
An authenticated clinician without high-sensitivity permission logs in.
- 02Direct loader requested
The Clinical Notes or Care Plan direct loader is requested via load_form.php.
- 03Restricted content returned
The restricted encounter form content and a CSRF token are returned.
- 04Changes submitted
save.php is submitted with the token to modify the record.
What happened
OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records. The record rates it high at CVSS 8.6 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.
High-sensitivity markings exist for the most delicate records, and this flaw ignores them entirely. The flaw is fixed in OpenEMR 8.3.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.3.0 or later.
- Review load_form.php logs for high-sensitivity form access by clinicians without the permission.
- Audit high-sensitivity encounter forms for unauthorized reads and edits.
- Notify affected patients if access cannot be excluded.
- Verify the deployed version after updating.
Management note
High-sensitivity restrictions that do not hold are worse than no restriction, because people relied on them. Audit those forms first.