CVE-2026-124476
Received Received - Intake

Insecure Direct Object Reference in OpenEMR Portal Payment Records

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authenticated portal patients can submit portal-save, review-save, AuthorizeNet, Stripe, or Sphere requests to insert or modify forged payment-audit records in other patients' billing records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124476
EUVD
EUVD-2026-119531

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124476 is an Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR versions before 8.3.0. It exists in portal/lib/paylib.php where authenticated portal patients can manipulate the form_pid parameter or patient_id_cc value to forge payment-audit records in other patients' billing records without proper validation against the session patient.

Detection Guidance

To detect this vulnerability, inspect OpenEMR instances for unauthorized modifications to the onsite_portal_activity table. Check for suspicious form_pid parameters in payment processing requests (AuthorizeNet, Stripe, Sphere, portal-save, review-save). Review audit logs for cross-patient payment-audit writes or sequential patient ID tampering.

Impact Analysis

This vulnerability allows authenticated attackers to modify or create fraudulent payment records for other patients. This could lead to financial fraud, incorrect billing, disrupted reconciliation processes, and potential deniability for unauthorized transactions. Patient IDs being sequential integers makes it easier to automate attacks across all patients.

Compliance Impact

This vulnerability compromises data integrity by allowing unauthorized modifications to payment records. This could violate GDPR's integrity principle and HIPAA's integrity and accountability requirements, potentially leading to non-compliance and regulatory penalties due to unauthorized data tampering.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later. Replace all instances of $_POST['form_pid'] with the session-bound $pid value in portal/lib/paylib.php. Add validation in SaveAudit and CloseAudit functions to ensure session-bound patient ID matches the processed ID.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124476. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...