{"id":"CVE-2026-124486","published":"2026-11-08T14:18:18.073","lastModified":"2026-11-10T21:46:35.763","description":"OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.3.0 lacks proper authorization checks in its classic document controller, allowing low-privilege authenticated users to move other patients' documents into their own category and retrieve them without specifying a patient ID, leading to unauthorized access and modification of protected health information (PHI).","exploitability":"Exploitation requires only low-privilege authentication and knowledge of the vulnerable endpoint (move_action_process), with no complex conditions or bypasses needed.","blast_radius":"Successful exploitation enables any authenticated low-privilege user to exfiltrate, alter, or delete PHI for arbitrary patients, potentially affecting all records in the system and violating HIPAA compliance.","remediation":"Upgrade to OpenEMR version 8.3.0 or later, which includes the official fix for this missing authorization vulnerability.","detection":"Defenders should monitor server logs for requests to /interface/documents/move_action_process with an empty patient_id parameter or unexpected category changes (e.g., patients|demo) initiated by users lacking elevated permissions; such anomalies may indicate attempted exploitation.","tags":["auth-bypass","phii-exfiltration","web-app","missing-authorisation","openemr"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:58.661Z"}}