{"id":"CVE-2026-124486","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-124486","summary":"OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients'…","details":"OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.","published":"2026-11-08T14:18:18.073","modified":"2026-11-08T14:18:18.073","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-08T14:18:18.073"}}