EUVD-2026-119532

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove reca...

CVE-2026-124477 OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove reca...

CVE-2026-124477

OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw within the save.php component. The issue resides in the delete_Recall action, where the application fails to perform sufficient Access Control List (ACL) or ownership checks. This allows low-privileged authenticated us...

CVE-2026-124477: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to…

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove reca...