CVE-2026-124462

OpenEMR versions before 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. The root cause is a case-sensitive authorization guard; authenticated portal patients can bypass the lowercase pid check by providing a c...

CVE-2026-124455

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to access the documents of other patients by providing malicious request parameters—such...