Authorization Bypass Vulnerability in OpenEMR by OpenEMR

CVE-2026-124458

What is CVE-2026-124458?

OpenEMR versions prior to 8.4.0 are susceptible to an authorization bypass vulnerability within the FHIR GET /fhir/Person/:uuid route. This flaw allows users of the patient portal with a valid SMART token and the patient/Person.read permission to evade compartment constraints and access sensitive demographic information of staff members. Attackers can exploit this issue to retrieve names, home addresses, phone numbers, and personal email addresses of staff by leveraging harvested Person UUIDs from appointment references, leading to significant privacy breaches.

References