Quick answers
- Is CVE-2026-124476 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-124476 being exploited in the wild.
- How severe is CVE-2026-124476?
- Medium severity, with a CVSS score of 6.5, published 8 November 2026.
- Which products and versions are affected?
- OpenEMR before 8.3.0.
- Is there a fix for CVE-2026-124476?
- Yes: fixed in 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-124476 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-124476?
- Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 8.3.0
Technical details
The vulnerability is an insecure direct object reference (IDOR) in portal/lib/paylib.php where five endpoints (portal-save, review-save, AuthorizeNet, Stripe, Sphere modes) trust the request-supplied form_pid parameter instead of validating it against the authenticated session's patient ID. Although CSRF protection is correctly enforced, the session-derived patient ID is never compared against the attacker-controlled form_pid before writing payment audit records to the onsite_portal_activity table. An authenticated attacker can enumerate sequential patient IDs and inject or modify payment records with arbitrary narrative, invoice JSON, cardholder name, and card number for any victim.
Affected products
- OpenEMR OpenEMR before 8.3.0
Timeline
- 2026-11-08: disclosed
- 2026-08-18: patched: Advisory published; fixed version available as 8.3.0