CVE-2026-124481
Received Received - Intake

Improper Authorization in OpenEMR Rainforest Patient Portal Payments

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124481
EUVD
EUVD-2026-119536

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.4.0 has an improper authorization flaw in its Rainforest patient portal payments. The system trusts browser-supplied patientId, encounter, and amount values instead of verifying them against the authenticated session. Authenticated patients can tamper with JSON data sent to portal_payment.rainforest.php, causing the payin.authorized webhook to write forged ar_activity credits to other patients' encounters with incorrect amounts.

Detection Guidance

Check OpenEMR version with 'grep -r "OpenEMR" /var/www/html/openemr/version.php' or similar. Inspect portal_payment.rainforest.php and related files for improper validation of patientId, encounter, or amount parameters. Review webhook logs for unauthorized ar_activity credit entries.

Impact Analysis

This vulnerability allows authenticated portal patients to manipulate payments so that incorrect amounts are credited to other patients' encounters. For example, a $1 payment could be recorded as a $9999 credit, creating financial discrepancies and falsifying patient balances and receivables.

Compliance Impact

This vulnerability could lead to violations of HIPAA due to unauthorized access to patient financial data and incorrect billing records. It may also impact GDPR compliance by exposing personal data through tampered payment records and financial discrepancies.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Disable the Rainforest Portal Payments feature if not required. Implement server-side validation to ensure payment data matches the authenticated session. Review and correct any falsified ar_activity records.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...