CVE-2026-124478OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php

Beschreibung

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-j347-wp33-79q9) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php third-party-advisory