CVE-2026-124473

OpenEMR versions before 8.3.0 are vulnerable to a broken object-level authorization vulnerability within the SOAP note update API . The application fails to verify if the provided SOAP note ID (sid) correctly belongs to the specified patient and encounter. An authenticated user with encounters/no...