https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 02:26:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-124447 <p>OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request&#39;s patientId instead of the stored record&#39;s owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient&#39;s activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.</p> <p>OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request&#39;s patientId instead of the stored record&#39;s owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient&#39;s activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.</p> https://db.gcve.eu/vuln/fkie_cve-2026-124447 https://db.gcve.eu/vuln/ghsa-prmv-76ff-f3xm <p>OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request&#39;s patientId instead of the stored record&#39;s owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient&#39;s activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.</p> <p>OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request&#39;s patientId instead of the stored record&#39;s owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient&#39;s activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.</p> https://db.gcve.eu/vuln/ghsa-prmv-76ff-f3xm