CVE-2026-124475
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or overwrite patient_settings rows for victims to suppress notifications, tamper with consent flags, or alter portal preferences.