CVE-2026-124486

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke moveactionprocess to move a document into a patients|demo category, then retrieve it...