PT-2026-139990

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r ID to remove...