OpenEMR, a free and open source electronic health records application, contains an Insecure Direct Object Reference (IDOR) vulnerability in its legacy patient notes functions. The vulnerability exists in library/pnotes.inc.php where updates and deletes are performed using WHERE id = ? without verifying that the note belongs to a patient the user is authorized to access. Multiple web UI callers pass user-controlled note IDs directly to these functions. This is similar to CVE-2026-25745 but affects web UI code paths instead of REST API. The issue affects versions prior to 8.0.0.3 and has been patched in version 8.0.0.3.