{"id":"CVE-2026-124451","kind":"vulnerability","aliases":["CVE-2026-124451"],"related":[],"title":"OpenEMR: SMART on FHIR flaw lets users reach other patients' records","description":"OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.","summary":"OpenEMR's SMART on FHIR code skips the per-patient access check, so a logged-in user or a malicious SMART app can bind requests to any patient's ID. The attacker can then read and change other patients' FHIR records.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fhir","healthcare","openemr","other","self-hosted"],"not_affected_if":["fhir-api-disabled","version-8.4.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare it with the fixed release.\n- Look for SMART on FHIR or patient-access API enablement in the OpenEMR configuration.","fix":"- OpenEMR `8.4.0` or later, per the NVD description (\"before 8.4.0\").","status":"open","published_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:50:57+00:00","updated_at":"2026-11-08T14:50:57+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:50:57Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR `8.4.0` or later, per the NVD description (\"before 8.4.0\").","reach":"network","title":"OpenEMR: SMART on FHIR flaw lets users reach other patients' records","impact":"high","summary":"OpenEMR's SMART on FHIR code skips the per-patient access check, so a logged-in user or a malicious SMART app can bind requests to any patient's ID. The attacker can then read and change other patients' FHIR records.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","fhir","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and modifies other patients' health records","analyst_note":"Confirm default FHIR/SMART enablement and the exact vendor advisory wording at the github.com advisory linked from the NVD entry.","how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare it with the fixed release.\n- Look for SMART on FHIR or patient-access API enablement in the OpenEMR configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.4.0-or-later","fhir-api-disabled"],"who_is_affected":"Clinics and hospitals running OpenEMR with the SMART on FHIR API in use are exposed; the flaw sits in the bearer-token authorization check. Sites that do not enable the FHIR API, or that run OpenEMR 8.4.0 or later, can skip it. The sources do not say whether the default configuration exposes the API.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":4649,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124451':14A,17A '-2026':13A,16A '8.4.0':70C 'access':36B,110C 'app':48B,94C 'arbitrari':104C 'attack':58B 'authent':89C 'author':73C 'bearertokenauthorizationstrategy.php':85C 'bind':50B,101C 'bypass':74C 'chang':63B 'check':37B 'checkuserhasaccesstopati':83C 'code':30B 'contain':71C 'context':99C 'cve':12A,15A 'fhir':4A,18B,29B,66B,80C,114C 'flaw':5A 'gain':107C 'healthcar':19B 'host':24B 'id':56B 'implement':81C 'launch':98C 'let':6A 'log':41B 'logged-in':40B 'malici':46B,92C 'manipul':96C 'openemr':1A,20B,25B,68C 'patient':10A,35B,54B,65B,105C,113C 'per':34B 'per-pati':33B 'reach':8A 'read':61B 'read/write':109C 'record':11A,67B 'request':51B,102C 'resourc':115C 'return':87C 'self':23B 'self-host':22B 'skip':31B 'smart':2A,27B,47B,78C,93C 'token':97C 'true':88C 'unauthor':108C 'uncondit':86C 'user':7A,43B,90C 'uuid':106C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running OpenEMR with the SMART on FHIR API in use are exposed; the flaw sits in the bearer-token authorization check. Sites that do not enable the FHIR API, or that run OpenEMR 8.4.0 or later, can skip it. The sources do not say whether the default configuration exposes the API.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fhir","healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-124451':14A,17A '-2026':13A,16A 'cve':12A,15A 'fhir':4A 'flaw':5A 'let':6A 'openemr':1A 'patient':10A 'reach':8A 'record':11A 'smart':2A 'user':7A","search_b":"'access':36B 'app':48B 'attack':58B 'bind':50B 'chang':63B 'check':37B 'code':30B 'fhir':18B,29B,66B 'healthcar':19B 'host':24B 'id':56B 'log':41B 'logged-in':40B 'malici':46B 'openemr':20B,25B 'patient':35B,54B,65B 'per':34B 'per-pati':33B 'read':61B 'record':67B 'request':51B 'self':23B 'self-host':22B 'skip':31B 'smart':27B,47B 'user':43B","search_c":"'8.4.0':70C 'access':110C 'app':94C 'arbitrari':104C 'authent':89C 'author':73C 'bearertokenauthorizationstrategy.php':85C 'bind':101C 'bypass':74C 'checkuserhasaccesstopati':83C 'contain':71C 'context':99C 'fhir':80C,114C 'gain':107C 'implement':81C 'launch':98C 'malici':92C 'manipul':96C 'openemr':68C 'patient':105C,113C 'read/write':109C 'request':102C 'resourc':115C 'return':87C 'smart':78C,93C 'token':97C 'true':88C 'unauthor':108C 'uncondit':86C 'user':90C 'uuid':106C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:23:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124451","severity":null,"published_at":"2026-11-08T14:18:12+00:00","modified_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102087,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xjgw-qjm5-4mq6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:23:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102088,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-checkuserhasaccesstopatient-in-smart-on-fhir","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}