PT-2026-139967
CVE-2026-124451
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾