CVE-2026-124487
Received Received - Intake

Improper Authorization in OpenEMR Allows CCDA Exfiltration

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124487
EUVD
EUVD-2026-119542

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.4.0 has an improper authorization flaw in the FHIR DocumentReference $docref route. Low-privileged users with only demographics and documents permissions can exploit this by supplying a victim patient parameter to generate any patient's CCDA. This allows attackers to download the full-chart CCDA from Patient Documents and steal clinical data.

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/version.php. Inspect FHIR DocumentReference $docref endpoint logs for unauthorized CCDA generation requests. Monitor for unusual patient parameter values in POST /fhir/DocumentReference/$docref requests.

Impact Analysis

Attackers could access sensitive patient medical records, including full clinical histories, by exploiting this flaw. This could lead to privacy breaches, identity theft, or unauthorized disclosure of protected health information.

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access to protected health information and GDPR due to improper handling of personal data. Organizations using affected OpenEMR versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. If upgrading is not possible, restrict access to the FHIR DocumentReference $docref endpoint via firewall rules or web server configuration. Review and revoke any unauthorized CCDA documents generated by low-privileged users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...