EUVD-2026-119516

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read...

CVE-2026-124459

Versions of OpenEMR before 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists in multiple encounter-form view and save endpoints, specifically due to a lack of patient or encounter ownership checks. This allows authenticated clinical users to enumera...

CVE-2026-124459: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read...

PT-2026-139974

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read...