CVE-2026-124461

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

CVE-2026-124461 OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

CVE-2026-124461 OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

CVE-2026-124461 OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

EUVD-2026-119518

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

CVE-2026-124461

OpenEMR versions before 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the library/ajax/upload.php endpoint. The root cause is missing authorization , which allows any authenticated user to read and overwrite document data by providing an arbitrary doc_id. Att...

PT-2026-139976

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc id. Low-privilege users can enumerate doc id values with the fetch and save actions to disclose patie...

CVE-2026-124461: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...