CVE-2026-124462
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers can request the api/onsitedocuments endpoint with Pid set to another patient's id to overwrite the session-pinned criteria and read other patients' onsite documents containing PHI.