EUVD-2026-119533

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility...

CVE-2026-124478

OpenEMR versions before 8.3.0 are vulnerable to a missing authorization vulnerability in the addRecall action of the /interface/main/messages/save.php endpoint. This flaw allows low-privileged authenticated users to modify the recall data of arbitrary patients. By submitting a crafted new_pid con...

CVE-2026-124478 OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility...

CVE-2026-124478: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility...

PT-2026-139991

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new pid with recall, contact, provider, facilit...