CVE-2026-124478
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.