{"id":"CVE-2026-124480","kind":"vulnerability","aliases":["CVE-2026-124480"],"related":[],"title":"OpenEMR: low-privilege users can read other patients' questionnaire health data","description":"OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.","summary":"OpenEMR before 8.4.0 lets a low-privileged logged-in user skip FHIR scope checks by sending the APICSRFTOKEN header with a session-exposed token. An attacker can then call the QuestionnaireResponse FHIR endpoint and read site-wide questionnaire answers containing protected health information.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fhir","healthcare","openemr","other","self-hosted"],"not_affected_if":["no-fhir-api","openemr-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed files or admin footer; versions below `8.4.0` are in scope.\n- Confirm whether the FHIR API is enabled for your site.","fix":"- Upgrade OpenEMR to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:48:57+00:00","updated_at":"2026-11-08T14:48:57+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T14:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenEMR to `8.4.0` or later.","reach":"network","title":"OpenEMR: low-privilege users can read other patients' questionnaire health data","impact":"high","summary":"OpenEMR before 8.4.0 lets a low-privileged logged-in user skip FHIR scope checks by sending the APICSRFTOKEN header with a session-exposed token. An attacker can then call the QuestionnaireResponse FHIR endpoint and read site-wide questionnaire answers containing protected health information.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","fhir","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads site-wide patient questionnaire answers, exposing health data","analyst_note":"Confirm whether the FHIR API is enabled by default and check the vendor advisory on github.com for exact affected and fixed versions.","how_to_check":"- Check the OpenEMR version in the installed files or admin footer; versions below `8.4.0` are in scope.\n- Confirm whether the FHIR API is enabled for your site.\n- unknown for a direct test command; the sources do not give one.","plain_action":"","product_name":"OpenEMR","needs_analyst":true,"not_affected_if":["openemr-8.4.0-or-later","no-fhir-api"],"who_is_affected":"Any OpenEMR deployment before 8.4.0 that exposes the FHIR API to users with accounts is exposed, since the flaw needs only a low-privilege authenticated session. Sites that do not run OpenEMR or do not use its FHIR API are not affected. The sources do not say whether FHIR must be enabled by default.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4651,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124480':15A,18A '-2026':14A,17A '/fhir/questionnaireresponse':122C '8.4.0':29B,76C 'allow':83C 'answer':69B,128C 'api':109C 'apicsrftoken':46B,100C 'attack':55B,102C 'authent':87C 'author':79C 'bypass':80C 'call':58B,120C 'check':42B,118C 'contain':70B,77C 'cross':92C 'cross-pati':91C 'csrf':110C 'cve':13A,16A 'data':12A,96C 'endpoint':62B 'exfiltr':123C 'expos':52B,108C 'fhir':20B,40B,61B,94C,116C 'get':121C 'header':47B,101C 'health':11A,72B 'healthcar':21B 'host':26B 'inform':73B 'js':112C 'let':30B 'log':36B 'logged-in':35B 'low':3A,33B,85C 'low-privileg':2A,32B,84C 'openemr':1A,19A,22B,27B,74C 'patient':9A,93C 'phi':129C 'privileg':4A,34B,86C 'protect':71B 'questionnair':10A,68B,127C 'questionnairerespons':60B,95C 'read':7A,64B,90C 'reus':104C 'scope':41B,117C 'self':25B 'self-host':24B 'send':44B,98C 'session':51B,107C 'session-expos':50B,106C 'site':66B,125C 'site-wid':65B,124C 'skip':39B,115C 'token':53B,111C 'user':5A,38B,88C 'valu':113C 'vulner':81C 'wide':67B,126C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.4.0 that exposes the FHIR API to users with accounts is exposed, since the flaw needs only a low-privilege authenticated session. Sites that do not run OpenEMR or do not use its FHIR API are not affected. The sources do not say whether FHIR must be enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["fhir","healthcare","high","openemr","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124480':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':12A 'health':11A 'low':3A 'low-privileg':2A 'openemr':1A,19A 'patient':9A 'privileg':4A 'questionnair':10A 'read':7A 'user':5A","search_b":"'8.4.0':29B 'answer':69B 'apicsrftoken':46B 'attack':55B 'call':58B 'check':42B 'contain':70B 'endpoint':62B 'expos':52B 'fhir':20B,40B,61B 'header':47B 'health':72B 'healthcar':21B 'host':26B 'inform':73B 'let':30B 'log':36B 'logged-in':35B 'low':33B 'low-privileg':32B 'openemr':22B,27B 'privileg':34B 'protect':71B 'questionnair':68B 'questionnairerespons':60B 'read':64B 'scope':41B 'self':25B 'self-host':24B 'send':44B 'session':51B 'session-expos':50B 'site':66B 'site-wid':65B 'skip':39B 'token':53B 'user':38B 'wide':67B","search_c":"'/fhir/questionnaireresponse':122C '8.4.0':76C 'allow':83C 'answer':128C 'api':109C 'apicsrftoken':100C 'attack':102C 'authent':87C 'author':79C 'bypass':80C 'call':120C 'check':118C 'contain':77C 'cross':92C 'cross-pati':91C 'csrf':110C 'data':96C 'exfiltr':123C 'expos':108C 'fhir':94C,116C 'get':121C 'header':101C 'js':112C 'low':85C 'low-privileg':84C 'openemr':74C 'patient':93C 'phi':129C 'privileg':86C 'questionnair':127C 'questionnairerespons':95C 'read':90C 'reus':104C 'scope':117C 'send':98C 'session':107C 'session-expos':106C 'site':125C 'site-wid':124C 'skip':115C 'token':111C 'user':88C 'valu':113C 'vulner':81C 'wide':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:37:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124480","severity":null,"published_at":"2026-11-08T14:18:17+00:00","modified_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102148,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:37:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102149,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-fhir-questionnaireresponse-apicsrftoken","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}