CVE-2026-124461 | BDVDB-2026-402016 Detail

Description#

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fetch and save actions to disclose patient health information and tamper with medical records across all patients.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-08Record published in the CVE List.