CVE-2026-124488OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

Beschreibung

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v58f-jcq4-pc4w) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters third-party-advisory