CVE-2026-124447 | OpenEMR up to 8.2.x OnsitePortalActivityController Update patientId resource injection

SecurityVulns
Yanac

A vulnerability, which was classified as critical, was found in OpenEMR up to 8.2.x. Affected by this issue is the function OnsitePortalActivityController::Update of the component OnsitePortalActivityController. The manipulation of the argument patientId results in improper control of resource identifiers.

This vulnerability is known as CVE-2026-124447. It is possible to launch the attack remotely. No exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More