CVE-2026-124481OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

Açıklama

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-525m-fch5-vqqm) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments third-party-advisory