CVE-2026-124487

OpenEMR versions before 8.4.0 are affected by an improper authorization vulnerability (CWE-863) in the non-patient POST /fhir/DocumentReference/$docref route. This flaw allows low-privileged users, who only possess demographics and documents permissions, to generate and download the full-chart CC...