CVE-2026-124480
Received Received - Intake

Authorization Bypass in OpenEMR Exposes PHI via FHIR API

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124480
EUVD
EUVD-2026-119535

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR versions before 8.4.0 have an authorization bypass flaw. Low-privileged authenticated users can read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to bypass FHIR scope checks and call GET /fhir/QuestionnaireResponse, allowing them to exfiltrate site-wide questionnaire answer PHI.

Detection Guidance

Check OpenEMR logs for repeated GET /fhir/QuestionnaireResponse requests with the APICSRFTOKEN header. Inspect network traffic for unauthorized FHIR API calls from low-privileged users. Verify if api_csrf_token_js values are exposed in session data or client-side scripts.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive patient health information (PHI) stored in FHIR QuestionnaireResponse data. Attackers could steal personal health data, leading to privacy breaches, identity theft, or compliance violations for organizations handling medical records.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information (PHI). GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for PHI. A breach could result in legal penalties, fines, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later. Disable or restrict access to FHIR API endpoints for low-privileged users. Ensure api_csrf_token_js values are not exposed in client-side scripts or session data. Review and audit FHIR API access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124480. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...