What is GHSA-hmxh-v4q7-5wcq?

GHSA-hmxh-v4q7-5wcq is a security advisory published by GitHub Security Advisories with High severity. OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing...

Which CVE IDs does GHSA-hmxh-v4q7-5wcq cover?

GHSA-hmxh-v4q7-5wcq covers the following CVE IDs: CVE-2026-124472. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hmxh-v4q7-5wcq?

GHSA-hmxh-v4q7-5wcq has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-hmxh-v4q7-5wcqHighCVSS 8.1

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-124472 →

📋 Description

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.

🔗 References (4)

https://github.com/openemr/openemr/security/advisories/GHSA-74j7-7q95-rvxg
https://nvd.nist.gov/vuln/detail/CVE-2026-124472
https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-via-sl-eob-patient-note-php
https://github.com/advisories/GHSA-hmxh-v4q7-5wcq