CVE-2026-124484 | OpenEMR up to 8.3.x Portal Onsite-Document APIs patientId improper authorization

November 8, 2026 Yanac

A vulnerability, which was classified as critical, has been found in OpenEMR up to 8.3.x. The affected element is an unknown function of the component Portal Onsite-Document APIs. Performing a manipulation of the argument patientId results in improper authorization.

This vulnerability is reported as CVE-2026-124484. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More