Improper Authorization in OpenEMR Product by OpenEMR

CVE-2026-124483

What is CVE-2026-124483?

An authorization vulnerability in OpenEMR versions before 8.4.0 allows authenticated staff users to misuse the prescription REST API. This occurs because the API incorrectly checks the patients.med access control list instead of the appropriate patients.rx list, enabling users with read-only access to sensitive medical history information to bypass access controls. As a consequence, staff can exploit the exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for any patient, and deactivate prescriptions across the entire tenant.

References