CVE-2026-124483
Received Received - Intake

Incorrect Authorization in OpenEMR Allows Prescription Manipulation

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124483
EUVD
EUVD-2026-119538

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.4.0 has an authorization flaw in its prescription REST API. The system checks the wrong permission (patients.med ACL) instead of the correct one (patients.rx) and does not require a specific permission bit. This allows authenticated staff users with read-only Medical/History access to bypass restrictions.

Detection Guidance

To detect this vulnerability, check OpenEMR versions before 8.4.0. Review API route configurations for incorrect ACL checks in prescription REST endpoints. Monitor for unauthorized prescription UUID enumeration or forged prescriptions by auditing API access logs for suspicious activity.

Impact Analysis

Attackers with staff access can exploit this to enumerate prescription UUIDs, create fake prescriptions for any patient, and deactivate existing prescriptions across the entire system. This could lead to unauthorized medication orders or disruptions in patient care.

Compliance Impact

This vulnerability likely violates compliance requirements for data integrity and access control under regulations like HIPAA (patient data protection) and GDPR (privacy and security). Unauthorized prescription modifications could lead to legal penalties and loss of trust.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later. Verify that prescription REST API routes use the correct patients.rx ACL and require specific permission bits. Restrict staff user permissions to prevent unauthorized API access. Rotate any exposed APICSRFTOKEN values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...