CVE-2026-124462 | OpenEMR up to 8.2.x OnsiteDocumentController Query Pid resource injection

November 8, 2026 Yanac

A vulnerability marked as critical has been reported in OpenEMR up to 8.2.x. Affected is the function OnsiteDocumentController::Query of the component OnsiteDocumentController. Performing a manipulation of the argument Pid results in improper control of resource identifiers.

This vulnerability is cataloged as CVE-2026-124462. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More