Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-124473 Overview
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.
Critical Impact
Affected Products
- OpenEMR: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-08: CVE-2026-124473 published to the National Vulnerability Database by disclosure@vulncheck.com
- 2026-11-08: last updated in the NVD database
Technical Details for CVE-2026-124473
Vulnerability Analysis
CVE-2026-124473 is a Insecure Direct Object Reference weakness (CWE-639: Insecure Direct Object Reference) in OpenEMR. Based on its CVSS vector, the flaw can be reached over the network, needs some level of access, and needs no user interaction. Changing an ID in a request exposes another user's data.
With a CVSS base score of 7.1, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The weakness is classified as CWE-639: Insecure Direct Object Reference. Changing an ID in a request exposes another user's data.
Attack Vector
Based on the CVSS vector, the flaw can be reached over the network, needs some level of access, and needs no user interaction. Attack complexity is low complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Detection Methods for CVE-2026-124473
Detection Strategies
- Inventory every instance of OpenEMR and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward OpenEMR application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-124473
Immediate Actions Required
- Apply the fixed version of OpenEMR named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for OpenEMR.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
- CWE-639: Insecure Direct Object Reference More CVEs with this weakness
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destroy other tenants' stored backups, including full node definitions, credential references, and authorization headers. This issue is fixed in version 2.56.1.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-124473 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications