Authorization Bypass in OpenEMR Affects Patient Data Privacy

CVE-2026-124464

What is CVE-2026-124464?

OpenEMR versions prior to 8.4.0 are susceptible to an authorization bypass vulnerability. This flaw enables patient-scoped SMART tokens to access questionnaire responses belonging to other patients, as the FhirQuestionnaireResponseService does not utilize the IPatientCompartmentResourceService. An attacker with a valid patient/QuestionnaireResponse.rs token can exploit this vulnerability to request patient responses through their UUID or retrieve an unfiltered bundle, potentially exposing sensitive clinical assessment answers across different patients.

References