CVE-2026-124478
Received Received - Intake

Missing Authorization in OpenEMR Allows Patient Recall Data Modification

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124478
EUVD
EUVD-2026-119533

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124478 is a missing authorization vulnerability in OpenEMR versions before 8.3.0. It allows low-privileged authenticated users to modify recall data for any patient by submitting a crafted request with a new_pid parameter and other fields like recall, contact, provider, facility, and notification preferences. The vulnerability exists in the addRecall action of /interface/main/messages/save.php.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /interface/main/messages/save.php with action=addRecall and a new_pid parameter. Check for unauthorized modifications to patient recall data by comparing records before and after suspicious activity. Review logs for requests from low-privileged users attempting to access or alter data outside their permissions.

Impact Analysis

This vulnerability allows attackers to overwrite recall and contact-related fields for any patient without proper authorization. This can lead to unauthorized data manipulation, compromised patient data integrity, and potential misuse of sensitive information. Attackers could alter recall dates, contact details, provider references, and notification preferences.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized modification of patient data. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Unauthorized changes to recall or contact data may violate these regulations, resulting in legal and financial penalties.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to /interface/main/messages/save.php for low-privileged users and implement strict input validation to block crafted requests with new_pid parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...