CVE WATCH / VULNERABILITY DETAIL
CVE-2026-124478
MEDIUMCVSS 6.5NVD feed
Published 8 November 2026 · tracked since 9 November 2026
Description
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility,
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-125198 LOW 2.5
- CVE-2026-125041 MEDIUM 5.5
- CVE-2026-125040 MEDIUM 6.5
- CVE-2026-121769 HIGH 8.5
- CVE-2026-60117 MEDIUM 6.2
- CVE-2026-123796
- CVE-2026-123373
- CVE-2026-123372
- CVE-2026-123371
- CVE-2026-123370