CVE-2026-124473 | BDVDB-2026-402028 Detail
openemropenemr
Description#
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-639 Authorization Bypass Through User-Controlled Key
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.