CVE-2026-124486

OpenEMR versions prior to 8.3.0 are affected by a missing authorization vulnerability within the classic document controller . This flaw allows low-privilege authenticated users to move documents into a patients|demo category by invoking move_action_process. Once moved, an attacker can retrieve t...