CVE-2026-124464

OpenEMR versions prior to 8.4.0 are vulnerable to an authorization bypass in the FhirQuestionnaireResponseService component. The root cause is the failure of this service to implement IPatientCompartmentResourceService , which prevents proper isolation of patient data. An attacker possessing a pa...

EUVD-2026-119521

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a...

CVE-2026-124464: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read…

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a...

PT-2026-139979

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a...