Is CVE-2026-124475 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124475 being exploited in the wild.

How severe is CVE-2026-124475?

High severity, with a CVSS score of 7.1, published 8 November 2026.

Is there a fix for CVE-2026-124475?

Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124475 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124475?

Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124475: OpenEMR insecure direct object reference in patient portal settings

CVE-2026-124475 · Severity: high · CVSS 7.1 · Published 2026-11-08

OpenEMR is an electronic health record system used by healthcare providers to manage patient data and portal accounts. A flaw in the patient portal allows any authenticated patient to modify another patient's settings—such as notification preferences, consent flags, and language settings—potentially causing them to miss critical medical alerts or exposing their health information. An attacker with a valid patient portal account can exploit this to suppress appointment reminders, hijack notifications to an attacker-controlled email address, or tamper with privacy consents.

Technologies: OpenEMR. Vendors: OpenEMR.

Quick answers

Is CVE-2026-124475 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124475 being exploited in the wild.
How severe is CVE-2026-124475?: High severity, with a CVSS score of 7.1, published 8 November 2026.
Which products and versions are affected?: OpenEMR before 8.3.0.
Is there a fix for CVE-2026-124475?: Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124475 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124475?: Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.3.0

Technical details

An insecure direct object reference (IDOR) vulnerability exists in portal/lib/persist.php where the setting_patient parameter is read directly from the JSON request body without validating it against the session-bound patient ID. Although CSRF tokens are correctly verified, the code fails to ensure the authenticated patient can only modify their own settings. The underlying SQL uses INSERT…ON DUPLICATE KEY UPDATE, allowing attackers to both insert new rows and silently overwrite existing patient_settings records, including notification opt-outs and consent flags.

Affected products

OpenEMR OpenEMR before 8.3.0

Timeline

2026-08-18: disclosed: GitHub Security Advisory published
2026-11-08: advisory: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.