EUVD-2026-119529

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

CVE-2026-124473

OpenEMR versions before 8.3.0 are vulnerable to a broken object-level authorization vulnerability within the SOAP note update API . The application fails to verify if the provided SOAP note ID (sid) correctly belongs to the specified patient and encounter. An authenticated user with encounters/no...

CVE-2026-124473: openemr: OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does…

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...