EUVD-2026-119517

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to...

CVE-2026-124460: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to...

PT-2026-139975

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to...