HIGH 8.7 NVD
CVE-2026-124480
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireRespo
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-fhir-qu
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.