CVE-2026-124460 | OpenEMR up to 8.2.x PortalPatientController Read patientId resource injection

A vulnerability categorized as problematic has been discovered in OpenEMR up to 8.2.x. The impacted element is the function PortalPatientController::Read of the component PortalPatientController. The manipulation of the argument patientId results in improper control of resource identifiers.

This vulnerability is identified as CVE-2026-124460. The attack can be executed remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More