Authorization Bypass in OpenEMR Affects Patient Data Security

CVE-2026-124482

What is CVE-2026-124482?

A security flaw in OpenEMR prior to version 8.4.0 allows low-privileged users leveraging the SMART protocol to bypass authorization controls. This weakness permits attackers to link arbitrary patient UUIDs within OAuth token contexts, enabling unauthorized access to sensitive clinical notes and documents. Users with minimal access rights can exploit this vulnerability to view patient-specific data through patient-scoped DocumentReference and Binary FHIR endpoints, significantly compromising patient confidentiality.

References