CVE-2026-124475

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability located in portal/lib/persist.php. This flaw allows authenticated portal patients to modify the settings of other patients by providing an arbitrary setting_patient value. Specifically, an a...

CVE-2026-124453

OpenEMR versions before 8.3.0 are vulnerable to an insecure direct object reference (IDOR) in the portal/lib/persist.php component. This flaw allows authenticated portal patients to modify the portal settings of other patients. By manipulating the setting_patient parameter within a JSON POST requ...