Missing Authorization in OpenEMR Portal Document APIs

Executive Summary

CVE-2026-124484 is a missing authorization vulnerability in OpenEMR versions before 8.4.0. It allows authenticated core users to access and modify documents belonging to other patients by omitting the patientId parameter and supplying arbitrary record IDs. This occurs due to improper authorization checks in the portal/patient onsite-document APIs.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with 'grep -r "version" /var/www/html/openemr/library/version.php' or via the web interface under Administration > Globals. Inspect API logs for requests to portal/patient/onsite-document endpoints without patientId parameters. Use network monitoring tools to detect unauthorized cross-patient document access attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with basic core user access to list, read, and overwrite sensitive portal documents, signatures, and template data across multiple patients. This could lead to unauthorized access to protected health information (PHI) and potential tampering with patient records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with standards like HIPAA and GDPR due to unauthorized access and potential disclosure of protected health information. It enables cross-patient data exposure and tampering, which are direct violations of patient privacy and data integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. If upgrading is not possible, restrict access to portal/patient/onsite-document APIs via firewall rules or web server configuration. Review and revoke any suspicious user sessions or document modifications.

Useful 0 Not Useful 0