CVE-2026-124449

OpenEMR versions before 8.4.0 are affected by a missing authorization vulnerability in the FHIR Media/:uuid and QuestionnaireResponse read routes. The root cause is that these routes skip ACL checks , allowing non-patient API tokens without specific OpenEMR ACLs to request resources by uuid. This...