CVE-2026-124455

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query that allows authenticated portal patients to read other patients' documents by overriding PidEquals criteria. Attackers can supply PidEquals, PidGreaterThan, or PidIn request...