Authorization Bypass in OpenEMR Affects Patient Data Security

CVE-2026-124451

What is CVE-2026-124451?

OpenEMR versions before 8.4.0 have a critical vulnerability within their SMART on FHIR implementation, which allows an authorization bypass. The function checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php fails to properly verify user access, returning true for all authenticated users. Consequently, this flaw enables attackers—whether they are malicious SMART applications or legitimate users—to exploit the system by altering the token launch context. This manipulation can lead to unauthorized read and write access to FHIR resources associated with arbitrary patient UUIDs, posing significant risks to patient data confidentiality and integrity.

References