CVE-2026-124462

OpenEMR versions before 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. The root cause is a case-sensitive authorization guard; authenticated portal patients can bypass the lowercase pid check by providing a c...