Authorization Bypass in OpenEMR Patient Portal API

Executive Summary

CVE-2026-124485 is an authorization bypass flaw in OpenEMR versions before 8.3.0. It affects the patient portal's onsitedocuments API, allowing authenticated patients to read other patients' documents by manipulating query parameters. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked filters, exposing sensitive data like consent bodies, signatures, file paths, and template information.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to the OpenEMR onsitedocuments endpoint for unusual parameters like empty pid_Equals or denialReason_IsNotLike values. Check logs for requests bypassing patient scoping filters. Use network monitoring tools to inspect HTTP requests targeting /onsitedocuments API paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to other patients' sensitive documents, including consent forms, signatures, and file paths. Attackers with valid credentials can exploit it to view or steal personal health information, leading to privacy breaches, identity theft, or legal consequences for affected individuals and healthcare providers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information. GDPR requires strict data access controls and breach notification, while HIPAA mandates safeguards for patient records. Exploitation could result in regulatory fines, legal penalties, and reputational damage for healthcare organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to the onsitedocuments API endpoint and implement strict input validation to block empty or malformed query parameters like pid_Equals and denialReason_IsNotLike.

Useful 0 Not Useful 0