CVE-2026-124472

OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw in interface/billing/sl_eob_patient_note.php. This vulnerability allows any authenticated user, including those with low-privilege accounts, to read and modify confidential patient billing notes. Attackers can exploit ...

EUVD-2026-119528

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobpatientnote.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patientid parameter and submit POST requests using the...

CVE-2026-124472 OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobpatientnote.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patientid parameter and submit POST requests using the...

CVE-2026-124472: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobpatientnote.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patientid parameter and submit POST requests using the...

PT-2026-139986

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl eob patient note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient id parameter and submit POST requests using...