CVE-2026-124480

OpenEMR versions before 8.4.0 are vulnerable to an authorization bypass allowing low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. The root cause involves an oversight where attackers can reuse the session-exposed api_csrf_token_js value to bypass FHIR sc...