CVE-2026-124460

OpenEMR versions before 8.3.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability in the PortalPatientController::Read() function. This flaw allows authenticated patients to access the pending demographic change requests of other patients by manipulating the patientId query s...