Insecure Direct Object Reference in OpenEMR Portal Activity

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenEMR versions before 8.3.0 contain a critical insecure direct object reference (IDOR) vulnerability in the OnsitePortalActivityController that fails to properly validate record ownership. Instead of checking whether the authenticated user owns the activity record they're modifying, the application only validates the patient ID in the request itself. This allows any authenticated portal patient to manipulate another patient's activity records by sending crafted PUT requests to the onsiteportalactivity API endpoint, potentially disclosing sensitive healthcare data, altering clinical narratives, and fraudulently assuming ownership of records. Healthcare organizations using OpenEMR portal functionality are directly affected, as patient-to-patient unauthorized access compromises both data confidentiality and integrity in a regulated healthcare environment.

Casky's 283 matching skills leverage Claude AI's reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection patterns including: anomalous API requests to onsiteportalactivity endpoints with mismatched patientId and activity ownership; suspicious PUT requests containing modified tableArgs, checksum, or narrative fields originating from authenticated sessions; and lateral access attempts where one patient's credentials access another patient's records. The platform's extended reasoning would flag the authorization bypass pattern—distinguishing between authentication (who you are) and authorization (what you can access)—surfacing findings that highlight how weak object-level access controls enable privilege escalation within the healthcare application, even when user authentication is valid.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124447.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-124447

Casky has 283 skills that investigate the attack patterns behind CVE-2026-124447. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn