CVE-2026-124451 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR's SMART on FHIR code skips the per-patient access check, so a logged-in user or a malicious SMART app can bind requests to any patient's ID. The attacker can then read and change other patients' FHIR records.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and hospitals running OpenEMR with the SMART on FHIR API in use are exposed; the flaw sits in the bearer-token authorization check. Sites that do not enable the FHIR API, or that run OpenEMR 8.4.0 or later, can skip it. The sources do not say whether the default configuration exposes the API.
Not affected if fhir-api-disabled, version-8.4.0-or-later
Who cares fhir, healthcare, openemr, self-hosted
version.php and compare it with the fixed release.8.4.0 or later, per the NVD description ("before 8.4.0").OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.