CVE-2026-124449

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An authorization flaw exists in the FHIR implementation where certain read routes skip Access Control List (ACL) checks. This allows users with non-patient API tokens that lack OpenEMR ACLs to request resources using a uuid, bypassing compartment filtering. Consequently, an attacker can read documents and questionnaire responses belonging to any patient via the '/FHIR Media/:uuid' and '/QuestionnaireResponse' endpoints.

Recommendations Update to version 8.4.0 or later.