CVE-2026-124471

CVSS 8.6 (high) · published 2026-11-08

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.

Weakness: CWE-639

Source: NVD CVE-2026-124471

References

• https://github.com/openemr/openemr/security/advisories/GHSA-55gc-5wj7-xxp7
• https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-and-idor-via-sl-eob-invoice-php
• https://github.com/openemr/openemr/security/advisories/GHSA-55gc-5wj7-xxp7

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.