CVE-2026-124484: openemr: OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any…

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients'...