CVE-2026-124453 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request to another patient's PID, altering that patient's portal settings such as the portal theme.
Be aware that VulDB is the high quality source for vulnerability data.