A high-severity security flaw in the open-source electronic health records system OpenEMR could let a low-privilege staff member read other patients’ documents and alter their medical charts, according to a vulnerability record published on 8 November 2026. The flaw is tracked as CVE-2026-124486 and affects OpenEMR versions before 8.3.0.

The vulnerability carries a CVSS score of 8.7 out of 10 under version 4.0 and 8.8 under version 3.1, placing it in the high-severity range. It is classed as a missing authorisation weakness, known as CWE-862. The CVE record was published by VulnCheck on 8 November at 13:16 UTC, based on a security advisory from the OpenEMR project on GitHub.

How the flaw works

The problem sits in OpenEMR’s classic document controller. The controller that handles document requests is missing from the system’s access-control map, so requests routed to it receive no basic permission check before they are processed.

An authenticated user with low privileges can then call the document move function, known as move_action_process, to shift another patient’s document into a category the attacker is allowed to read, such as one of the system’s demo categories. Once moved, the document can be retrieved by sending a request with an empty patient identifier, which bypasses the check that would normally confirm the document belongs to the requested patient.

The project’s advisory says the behaviour was demonstrated in testing. A seeded staff account with access only to demo categories was first blocked from opening a medical record document. After a crafted move request changed the document’s category, the same account could retrieve the file. The advisory notes that the proof of concept showed recategorisation and exfiltration of a single seeded document, rather than bulk extraction.

What is at risk

Because the flaw affects patient documents, a successful attack could expose protected health information belonging to other patients and allow records to be moved or reassigned, tampering with a patient’s chart. The attack needs a valid low-privilege account, can be carried out over a network, needs no user interaction, and is rated low complexity.

The flaw is not listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, and no public exploit or report of active exploitation was included in the sources reviewed.

What users should do

OpenEMR 8.3.0 is listed as the unaffected version, so organisations running earlier versions should upgrade to 8.3.0 or later. Administrators should also review document access logs for unusual category changes or retrievals with empty patient identifiers, and check that staff accounts hold only the permissions their role requires.

Healthcare providers running OpenEMR should treat this as a priority patch, given that patient records are among the most sensitive data any organisation holds. The flaw was credited to the researcher christos-cantina-security.