Authenticated Document Access Flaw in OpenEMR

Executive Summary

CVE-2026-124461 is a missing authorization vulnerability in OpenEMR versions before 8.3.0. It exists in library/ajax/upload.php where any authenticated user can read or overwrite document data by providing an arbitrary doc_id. The issue allows low-privilege users to access or modify medical records across all patients without proper access controls.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.3.0 for the vulnerable file library/ajax/upload.php. Monitor network traffic for unauthorized document access attempts using doc_id parameters. Review logs for suspicious fetch or save actions from low-privilege users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive patient health information and tampering with medical records. Attackers can enumerate document IDs to disclose protected data or alter records, potentially causing privacy breaches and incorrect medical treatments.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information and lack of proper access controls. It can result in data breaches, non-compliance with privacy regulations, and potential legal penalties for organizations using affected OpenEMR versions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.3.0 or later. Implement strict ACL checks in library/ajax/upload.php to verify document ownership and user permissions. Disable or restrict access to the DICOM document-state AJAX handler for non-admin users until patched.

Useful 0 Not Useful 0