PT-2026-139979

CVE-2026-124464

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An authorization bypass exists because the FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. This allows users with patient-scoped SMART tokens to access questionnaire responses belonging to other patients. An attacker possessing a patient/QuestionnaireResponse.rs token can request specific responses by uuid or list an unfiltered bundle to retrieve clinical assessment answers across different patients.

Recommendations Update to version 8.4.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Aquibaquil

Cyberkareem

Tike00

Vendors

Affected products

Weakness enumeration