OpenEMR Vulnerabilities Expose Patient Data to Unauthorized Access

• •OpenEMR versions before 8.3.0 are vulnerable to IDOR attacks.
• •Two distinct vulnerabilities could expose patient data across accounts.
• •Users are urged to upgrade to version 8.3.0 to mitigate risks.

Two vulnerabilities have been identified in OpenEMR versions prior to 8.3.0, allowing for unauthorized access to patient data. The first vulnerability involves a cross-patient IDOR (Insecure Direct Object Reference) via encounter form viewers and save handlers. The second vulnerability allows IDOR in portal patient settings through a persist PHP file. These flaws could potentially allow attackers to access sensitive patient information across different accounts. The vulnerabilities are tracked under CVE-2026-XXXX and CVE-2026-YYYY, respectively. OpenEMR has not yet confirmed any of these vulnerabilities, but they are to address. Users are advised to upgrade to version 8.3.0 or later to mitigate these risks. No specific details on the exploitation status have been disclosed.