CVE-2026-124470OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

Açıklama

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ parameter names to retrieve other patients' problem titles, clinical notes, ICD diagnosis codes, and IPPF contraceptive records.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-xcrj-xc98-x8g6) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists third-party-advisory