OPENEMR · CVE-2026-124480 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 lets a low-privileged logged-in user skip FHIR scope checks by sending the APICSRFTOKEN header with a session-exposed token. An attacker can then call the QuestionnaireResponse FHIR endpoint and read site-wide questionnaire answers containing protected health information.
first public Sep 13, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any OpenEMR deployment before 8.4.0 that exposes the FHIR API to users with accounts is exposed, since the flaw needs only a low-privilege authenticated session. Sites that do not run OpenEMR or do not use its FHIR API are not affected. The sources do not say whether FHIR must be enabled by default.
Not affected if no-fhir-api, openemr-8.4.0-or-later
Who cares fhir, healthcare, openemr, self-hosted
8.4.0 are in scope.8.4.0 or later.OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.