Authorization Bypass in OpenEMR Allows Unauthorized Access to Patient Data

CVE-2026-124480

What is CVE-2026-124480?

OpenEMR prior to version 8.4.0 contains a significant authorization bypass vulnerability that permits low-privileged authenticated users to access sensitive FHIR QuestionnaireResponse data across multiple patients. This issue arises when an attacker exploits the APICSRFTOKEN header, allowing them to use the session-exposed api_csrf_token_js value to bypass FHIR scope checks. Consequently, this can lead to unauthorized read access to site-wide questionnaire answers, risking the exposure of protected health information (PHI).

References