CVE-2026-124458

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An authorization bypass exists in the FHIR GET '/fhir/Person/:uuid' endpoint. This issue allows users of the patient portal to bypass compartment enforcement—a security mechanism used to isolate data—and access demographics of any staff member. An attacker possessing a patient SMART token with patient/Person.read permissions can obtain staff Person uuid values from Appointment references to retrieve sensitive information, including names, home addresses, phone numbers, and personal emails.

Recommendations Update to version 8.4.0 or later.