CVE-2026-124483 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 checks the wrong access control on its prescription REST API, so staff with read-only medical history access pass the check. Those users can enumerate prescription IDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the whole tenant.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and hospitals running self-hosted OpenEMR before 8.4.0 with the REST API reachable by staff accounts. Exposure depends on users who hold only read-only Medical/History access; sites without such accounts have lower risk.
Not affected if no-rest-api-exposure, openemr-8.4.0-or-later
Who cares healthcare, openemr, rest-api, self-hosted
8.4.0 or later (per the advisory title, the fix is in 8.4.0).OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.