CVE-2026-124451

OpenEMR versions prior to 8.4.0 are vulnerable to an authorization bypass within its SMART on FHIR implementation. The root cause is located in BearerTokenAuthorizationStrategy.php, where the checkUserHasAccessToPatient() function unconditionally returns true. This flaw allows authenticated users...