CVE-2026-124451
Received Received - Intake

Authorization Bypass in OpenEMR SMART on FHIR

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124451
EUVD
EUVD-2026-119509

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass flaw in OpenEMR's SMART on FHIR implementation. The checkUserHasAccessToPatient() function in BearerTokenAuthorizationStrategy.php unconditionally returns true, allowing authenticated users or malicious SMART apps to manipulate token launch context and bind requests to arbitrary patient UUIDs without proper authorization.

Detection Guidance

Check OpenEMR version with command: grep -r "version" /var/www/html/openemr/library/version.php. If version is below 8.4.0, the system is vulnerable. Review BearerTokenAuthorizationStrategy.php for the checkUserHasAccessToPatient() function returning true unconditionally.

Inspect FHIR API logs for unusual patient UUID bindings or unauthorized access attempts. Monitor for requests binding to arbitrary patient UUIDs without proper authorization checks.

Impact Analysis

An attacker with valid access credentials could exploit this to gain unauthorized read/write access to other patients' Protected Health Information (PHI) by manipulating the patient UUID in the token context. This compromises patient-data isolation and could lead to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access to PHI. GDPR requires strict data access controls and breach notification, while HIPAA mandates safeguards to protect patient data. Exploitation could result in non-compliance penalties and legal consequences.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. If upgrading is not possible, apply the patch from the OpenEMR security advisory. Ensure checkUserHasAccessToPatient() properly validates user access to patient data before returning true.

Review and restrict access to SMART on FHIR endpoints. Implement additional logging and monitoring for FHIR API requests to detect unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...