{"id":"CVE-2026-124484","published":"2026-11-08T14:18:17.773","lastModified":"2026-11-10T21:46:29.807","description":"OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpg","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-in-portal-onsite-document-apis","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpg","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.4.0 lacks authorization checks on its portal onsite-document APIs, allowing any authenticated core user to access, read, list, and overwrite other patients' documents by omitting the patientId parameter and specifying arbitrary record IDs. This violates patient data isolation and enables unauthorized modification of sensitive medical records.","exploitability":"Exploitation requires only valid authentication as a core user with portal access; no special privileges or technical sophistication beyond API interaction is needed.","blast_radius":"A successful exploit could enable full read/write access to any patient's portal documents, signatures, and templates within the system, compromising confidentiality, integrity, and availability of protected health information across the entire patient population.","remediation":"Upgrade to OpenEMR version 8.4.0 or later, which includes the required authorization enforcement for the affected portal onsite-document APIs.","detection":"Defenders should monitor server logs for API requests to /portal/onsite-document endpoints where the patientId parameter is missing or inconsistent with the authenticated user's assigned patients, especially when combined with non-null recordId values referencing other patients' records.","tags":["auth-bypass","missing-authorization","healthcare","api-abuse","cross-patient-access"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:49.938Z"}}