{"id":"CVE-2026-124477","published":"2026-11-08T14:18:16.653","lastModified":"2026-11-10T21:46:42.493","description":"OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-776r-c638-hw6j","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-via-delete-recall-in-save-php","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-776r-c638-hw6j","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR versions before 8.3.0 lack authorization checks on the delete_Recall action, allowing low-privileged authenticated users to delete arbitrary patient recall records by sending a POST request to /interface/main/messages/save.php with target parameters. This violates the principle of least privilege and enables data destruction without proper access controls.","exploitability":"Exploitation is straightforward for authenticated low-privileged users (e.g., clinic staff) as it requires only sending a standard POST request with predictable parameters (pid, r_ID) to a publicly accessible endpoint.","blast_radius":"Successful exploitation enables unauthorized deletion of critical clinical recall data, potentially compromising patient safety, disrupting care workflows, and violating HIPAA data integrity requirements.","remediation":"Upgrade to OpenEMR version 8.3.0 or later, which includes the missing authorization fix for the delete_Recall action.","detection":"Defenders should monitor server access logs for POST requests to /interface/main/messages/save.php containing r_ID and pid parameters, especially when issued by users without clinical or administrative privileges; anomalous bulk deletions of recall records in audit logs may also indicate exploitation.","tags":["auth-bypass","web-app","data-destruction","openemr","low-privilege","patient-data"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:30.949Z"}}