Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-124480: OpenEMR <8.4.0 lets low-privilege users view other patients’ data
CVE-2026-124480 · published today
Summary
In versions of OpenEMR released before 8.4.0, a user with limited rights can see questionnaire answers belonging to other patients. This exposes personal health information that should be private. Update OpenEMR to version 8.4.0 or later, and ensure any custom extensions also enforce proper patient‑level checks.
Original advisory text
OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6 Vendor Advisory
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-v... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-1244... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-124480 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-862Missing Authorization
Timeline
Published8 Nov 2026
Updated9 Nov 2026
First seen8 Nov 2026
Track software like this
Free during beta