CVE-2026-124460
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.