CVE-2026-124456 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list_report.php to view all patients' names, MRNs, insurance and prior-auth data, or submit arbitrary id values to public/index.php to overwrite other patients' prior-authorization records.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.