CVE-2026-124449: OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes

Published Nov 8, 2026

Updated

OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and questionnaire responses.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a non-patient OpenEMR API token that lacks OpenEMR ACLs. No user interaction is required, and the vulnerable routes are network-accessible.

What information could be exposed?

The issue can expose any patient's documents through the FHIR Media route and questionnaire responses through the QuestionnaireResponse read route. An attacker requests the targeted resource by UUID, bypassing compartment filtering.

Are patient API tokens affected?

The available information specifically identifies non-patient API tokens lacking OpenEMR ACLs as the affected token type. It does not establish whether patient API tokens are vulnerable.

What versions are affected?

OpenEMR versions before 8.4.0 are affected. Upgrading to 8.4.0 or later addresses the stated affected-version range.

CVE-2026-124449: OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are patient API tokens affected?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Are patient API tokens affected?

What versions are affected?