EUVD-2026-119553

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another...

CVE-2026-124447

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) in the OnsitePortalActivityController::Update() method. The root cause is that the system validates the patientId provided in the request rather than the owner of the stored record. Consequently, an authe...

PT-2026-139963

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another...

CVE-2026-124447: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another...