Is CVE-2026-124472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124472 being exploited in the wild.

How severe is CVE-2026-124472?

High severity, with a CVSS score of 8.1, published 8 November 2026.

Is there a fix for CVE-2026-124472?

Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124472 attacked?

It is attacked over the network.

Am I affected by CVE-2026-124472?

Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124472: OpenEMR missing authorization in billing note interface

CVE-2026-124472 · Severity: high · CVSS 8.1 · Published 2026-11-08

OpenEMR is an open-source electronic health records system used by healthcare practices to manage patient data. A missing authorization flaw allows any logged-in user, including those without billing privileges, to view and modify confidential patient billing notes containing sensitive financial and health information. This could lead to unauthorized access to protected health information, account tampering, and HIPAA violations.

Technologies: OpenEMR. Vendors: OpenEMR.

Quick answers

Is CVE-2026-124472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124472 being exploited in the wild.
How severe is CVE-2026-124472?: High severity, with a CVSS score of 8.1, published 8 November 2026.
Which products and versions are affected?: OpenEMR before 8.3.0.
Is there a fix for CVE-2026-124472?: Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124472 attacked?: It is attacked over the network.
Am I affected by CVE-2026-124472?: Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.3.0

Technical details

The vulnerability is a missing access control check (CWE-862) in interface/billing/sl_eob_patient_note.php that fails to verify user ACL permissions (acct/eob/write) or patient chart visibility before reading or writing the billing_note column. An authenticated attacker can enumerate patient_id query parameters and retrieve or modify billing notes via POST requests with the CSRF token embedded in the same response. The flaw affects all versions before 8.3.0 and requires only network access and valid authentication.

Affected products

OpenEMR OpenEMR before 8.3.0

Timeline

2026-08-18: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.