Openemr Before 8.3.0 Cross Patient Idor Via Encounter Form Viewers And Save Handlers

Back www.vulncheck.com

Openemr Before 8.3.0 Cross Patient Idor Via Encounter Form Viewers And Save Handlers

www.vulncheck.com • November 9, 2026

Share: View original

OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers

openemr >= 0, = 0, < 8.3.0

CWE-639 Authorization Bypass Through User-Controlled Key

GitHub Security Advisory (GHSA-3mg9-27fw-m9j6)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenEMR Vulnerabilities Expose Patient Data to Unauthorized Access Two vulnerabilities have been identified in OpenEMR versions prior to 8.3.0, allowing for unauthorized access to patient data. The first vulnerability involves a cross-patient IDOR (Insecure Direct Object Reference) via encounter form viewers and save handlers. The second vulnerability allows IDOR in portal patient settings through a persist PHP file. These flaws could potentially allow attackers to access sensitive patient information across different accounts. The vulnerabilities are tracked under CVE-2026-XXXX and CVE-2026-YYYY, respectively. OpenEMR has not yet confirmed any of these vulnerabilities, but they are to address. Users are advised to upgrade to version 8.3.0 or later to mitigate these risks. No specific details on the exploitation status have been disclosed. 57

Extracted Entities

CWE Weaknesses (1)

CWE-639 - Authorization Bypass Through User-Controlled Key (IDOR)

Vulnerabilities (1)

CWE-639 - Authorization Bypass Through User-Controlled Key