CVE-2026-124480

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An authorization bypass allows low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. By utilizing the session-exposed api csrf token js value within the APICSRFTOKEN header, an attacker can bypass FHIR scope checks. This enables the unauthorized calling of the GET '/fhir/QuestionnaireResponse' endpoint to exfiltrate site-wide protected health information (PHI) from questionnaire answers.

Recommendations Update to version 8.4.0 or later.