CVE-2026-124447

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) in the OnsitePortalActivityController::Update() method. The root cause is that the system validates the patientId provided in the request rather than the owner of the stored record. Consequently, an authe...