CVE-2026-124475

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary settingpatient value. Attackers can insert or overwrite patientsettings rows for victims...