CVE-2026-124482 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 lets a low-privileged SMART standalone-launch user bind an arbitrary patient UUID into an OAuth token. The attacker then reads that patient's clinical notes and documents through the FHIR DocumentReference and Binary endpoints.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running OpenEMR before 8.4.0 with SMART on FHIR standalone launch that have users holding the patients|demo ACL. Attackers need that low-privileged account first; the sources do not say whether the flaw is reachable without SMART apps configured.
Not affected if no-smart-standalone-launch, openemr-8.4.0-or-later
Who cares fhir, healthcare, openemr, self-hosted
8.4.0 are affected.8.4.0 (the first version not affected, per the vendor advisory reference).OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and documents through patient-scoped DocumentReference and Binary FHIR endpoints.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.