CVE-2026-124472 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.