CVE-2026-124477 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.