---
id: "CVE-2026-124451"
page: "https://infrastack.ai/live/CVE-2026-124451"
kind: "vulnerability"
aliases: ["CVE-2026-124451"]
title: "OpenEMR: SMART on FHIR flaw lets users reach other patients' records"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fhir", "healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["fhir-api-disabled", "version-8.4.0-or-later"]
published_at: "2026-11-08T14:18:12+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:50:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124451", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# OpenEMR: SMART on FHIR flaw lets users reach other patients' records

Link for people: https://infrastack.ai/live/CVE-2026-124451 (this .md is for agents)

OpenEMR's SMART on FHIR code skips the per-patient access check, so a logged-in user or a malicious SMART app can bind requests to any patient's ID. The attacker can then read and change other patients' FHIR records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenEMR version in the admin footer or `version.php` and compare it with the fixed release.
- Look for SMART on FHIR or patient-access API enablement in the OpenEMR configuration.

## Fix

- OpenEMR `8.4.0` or later, per the NVD description ("before 8.4.0").

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124451

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-xjgw-qjm5-4mq6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-checkuserhasaccesstopatient-in-smart-on-fhir

## From the sources

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_