CVE-2026-124483

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An incorrect authorization issue exists because the prescription REST API routes validate the patients.med Access Control List (ACL) instead of the patients.rx ACL and do not request a specific permission bit. This allows users with read-only Medical/History access to bypass intended restrictions. Authenticated staff users can utilize the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the entire tenant.

Recommendations Update to version 8.4.0 or later.