Missing Authorization Vulnerability in OpenEMR by OpenEMR

CVE-2026-124449

What is CVE-2026-124449?

OpenEMR versions prior to 8.4.0 exhibit a serious missing authorization flaw within the FHIR Media/:uuid and QuestionnaireResponse read routes. This vulnerability allows API tokens, which do not possess proper OpenEMR access control lists (ACLs), to access sensitive patient documents and questionnaire responses by requesting resources directly using their UUIDs. As a result, unauthorized access to personal health information can occur, highlighting a significant risk to patient confidentiality and data integrity.

References