CVE-2026-124480: OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN

Published Nov 8, 2026

Updated

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed apicsrftokenjs value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privileged authenticated OpenEMR user can exploit it. The attacker needs access to their session-exposed api_csrf_token_js value and can then send it in the APICSRFTOKEN header.

What data can be accessed if exploitation succeeds?

The issue permits reading FHIR QuestionnaireResponse data across patients through GET /fhir/QuestionnaireResponse. This can expose site-wide questionnaire-answer PHI.

Which installations are affected?

OpenEMR versions before 8.4.0 are affected, based on the provided advisory information.

CVE-2026-124480: OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can be accessed if exploitation succeeds?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can be accessed if exploitation succeeds?

Which installations are affected?