CVE-2026-124480

OpenEMR versions before 8.4.0 are vulnerable to an authorization bypass allowing low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. The root cause involves an oversight where attackers can reuse the session-exposed api_csrf_token_js value to bypass FHIR sc...

EUVD-2026-119535

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed apicsrftokenjs value to skip FHIR scope checks and...

CVE-2026-124464

OpenEMR versions prior to 8.4.0 are vulnerable to an authorization bypass in the FhirQuestionnaireResponseService component. The root cause is the failure of this service to implement IPatientCompartmentResourceService , which prevents proper isolation of patient data. An attacker possessing a pa...

EUVD-2026-119551

OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and...

CVE-2026-124449

OpenEMR versions before 8.4.0 are affected by a missing authorization vulnerability in the FHIR Media/:uuid and QuestionnaireResponse read routes. The root cause is that these routes skip ACL checks , allowing non-patient API tokens without specific OpenEMR ACLs to request resources by uuid. This...

CVE-2026-124480: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to…

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed apicsrftokenjs value to skip FHIR scope checks and...

CVE-2026-124449: openemr: OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read…

OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and...