CVE-2026-33931CWE-639

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

Medium · published March 25, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records — including invoice/billing data (PHI) and payment card metadata — by manipulating the `recid` query parameter in `portal/portal_payment.php`. Version 8.0.0.3 patches the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-25T23:36Z
EPSS history
Timeline
  • 25 MAR 23:36Z
    OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access
    cvelistv5