Dashboard / CVE-2026-124460

CVE-2026-124460

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the patientId query string parameter to retrieve PHI including names, addresses, SSNs, and insurance information.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
openemr openemr 0 < 8.3.0
openemr openemr 0 < 8.3.0

References & Advisories (2)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.26%
Raw Score 0.002580
Percentile 17.6%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00258
2026-11-12
0.00258
2026-11-10
0.00258
2026-11-09
0.00258

Intelligence Sources

mitre ref →
nvd ref →

External Links