CVE-2026-124485

OpenEMR versions prior to 8.3.0 are vulnerable to an authorization bypass within the patient portal onsitedocuments API . By sending empty pid_Equals and denialReason_IsNotLike parameters, an authenticated patient can override query criteria to remove patient scoping and locked filters. This flaw...

CVE-2026-124455

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to access the documents of other patients by providing malicious request parameters—such...