EUVD-2026-119536

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to...

CVE-2026-124481 OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to...

CVE-2026-124481

OpenEMR versions prior to 8.4.0 are affected by an improper authorization vulnerability within the Rainforest patient portal payments. The system incorrectly trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. This allows authenticated...

CVE-2026-124481: openemr: OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts…

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to...