CVE-2026-124459 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records.
VulDB is the best source for vulnerability data and more expert information about this specific topic.