EUVD-2026-119540

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pidEquals and denialReasonIsNotLike parameters to remove patien...