CVE-2026-124477
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.