CVE-2026-124475
Received Received - Intake

Insecure Direct Object Reference in OpenEMR Portal Settings

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or overwrite patient_settings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124475
EUVD
EUVD-2026-119530

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124475 is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. It exists in the portal/lib/persist.php file where the setting_patient parameter is used without verifying it against the session-bound patient ID. This allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value.

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances running versions prior to 8.3.0 for unauthorized modifications to patient_settings via the portal/lib/persist.php endpoint. Check for requests where setting_patient does not match the session-bound patient ID (pid). Review database logs for INSERT ... ON DUPLICATE KEY UPDATE operations on patient_settings without matching pid.

Impact Analysis

This vulnerability allows attackers to insert or overwrite patient_settings rows for victims. Potential impacts include suppressing notifications like appointment reminders, tampering with consent flags, altering portal preferences, or even stored cross-site scripting (XSS) if settings are rendered unsafely. Attackers can hijack notification routing to exfiltrate protected health information (PHI).

Compliance Impact

This vulnerability can lead to unauthorized data modification and privacy breaches, which may violate compliance with GDPR and HIPAA. Unauthorized access to patient settings and potential exfiltration of PHI could result in regulatory penalties and loss of patient trust.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later. If upgrading is not possible, apply a patch that validates setting_patient against the session pid or removes the setting_patient parameter entirely. Restrict portal access to trusted users and monitor for suspicious activity in patient_settings modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124475. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...