CVE-2026-124470OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

Descripción

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-xcrj-xc98-x8g6) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists third-party-advisory