{"id":"CVE-2026-124483","kind":"vulnerability","aliases":["CVE-2026-124483"],"related":[],"title":"OpenEMR: read-only staff can forge and deactivate prescriptions","description":"OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.","summary":"OpenEMR before 8.4.0 checks the wrong access control on its prescription REST API, so staff with read-only medical history access pass the check. Those users can enumerate prescription IDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the whole tenant.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","rest-api","self-hosted"],"not_affected_if":["no-rest-api-exposure","openemr-8.4.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed release in the product ranges; unknown if the sources do not give a product range.\n- Review which staff accounts hold read-only Medical/History access and whether they use the prescription REST API.","fix":"- OpenEMR: move to `8.4.0` or later (per the advisory title, the fix is in 8.4.0).","status":"open","published_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:49:06+00:00","updated_at":"2026-11-08T14:49:06+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later (per the advisory title, the fix is in 8.4.0).","reach":"network","title":"OpenEMR: read-only staff can forge and deactivate prescriptions","impact":"high","summary":"OpenEMR before 8.4.0 checks the wrong access control on its prescription REST API, so staff with read-only medical history access pass the check. Those users can enumerate prescription IDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the whole tenant.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","rest-api"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker forges prescriptions for any patient and deactivates others.","analyst_note":"Confirm the affected version range and fixed release from the vendor advisory at github.com before publishing; the product list is empty.","how_to_check":"- Check the installed OpenEMR version against the fixed release in the product ranges; unknown if the sources do not give a product range.\n- Review which staff accounts hold read-only Medical/History access and whether they use the prescription REST API.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.4.0-or-later","no-rest-api-exposure"],"who_is_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.4.0 with the REST API reachable by staff accounts. Exposure depends on users who hold only read-only Medical/History access; sites without such accounts have lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4653,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124483':13A,16A '-2026':12A,15A '8.4.0':28B,73C 'access':32B,47B,103C 'acl':88C 'across':67B 'api':22B,38B,83C 'apicsrftoken':116C 'arbitrari':124C 'authent':107C 'author':77C 'bit':97C 'check':29B,50B,85C,106C 'contain':74C 'control':33B 'creat':57B 'cve':11A,14A 'deactiv':9A,64B,127C 'enumer':54B,118C 'exist':65B,128C 'expos':115C 'forg':7A,58B,121C 'healthcar':17B 'histori':46B 'host':25B 'id':56B 'incorrect':76C 'instead':89C 'medic':45B 'medical/history':102C 'openemr':1A,18B,26B,71C 'pass':48B,104C 'patient':62B,125C 'patients.med':87C 'patients.rx':91C 'permiss':96C 'prescript':10A,36B,55B,59B,66B,81C,119C,122C,129C 'read':3A,43B,100C 'read-on':2A,42B,99C 'request':93C 'rest':21B,37B,82C 'rest-api':20B 'reus':111C 'rout':84C 'self':24B 'self-host':23B 'specif':95C 'staff':5A,40B,108C 'tenant':70B,131C 'tenant-wid':130C 'ui':114C 'ui-expos':113C 'user':52B,109C 'uuid':120C 'vulner':78C 'whole':69B 'wide':132C 'wrong':31B","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.4.0 with the REST API reachable by staff accounts. Exposure depends on users who hold only read-only Medical/History access; sites without such accounts have lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","restapi","selfhosted"],"campaign_type":null,"search_a":"'-124483':13A,16A '-2026':12A,15A 'cve':11A,14A 'deactiv':9A 'forg':7A 'openemr':1A 'prescript':10A 'read':3A 'read-on':2A 'staff':5A","search_b":"'8.4.0':28B 'access':32B,47B 'across':67B 'api':22B,38B 'check':29B,50B 'control':33B 'creat':57B 'deactiv':64B 'enumer':54B 'exist':65B 'forg':58B 'healthcar':17B 'histori':46B 'host':25B 'id':56B 'medic':45B 'openemr':18B,26B 'pass':48B 'patient':62B 'prescript':36B,55B,59B,66B 'read':43B 'read-on':42B 'rest':21B,37B 'rest-api':20B 'self':24B 'self-host':23B 'staff':40B 'tenant':70B 'user':52B 'whole':69B 'wrong':31B","search_c":"'8.4.0':73C 'access':103C 'acl':88C 'api':83C 'apicsrftoken':116C 'arbitrari':124C 'authent':107C 'author':77C 'bit':97C 'check':85C,106C 'contain':74C 'deactiv':127C 'enumer':118C 'exist':128C 'expos':115C 'forg':121C 'incorrect':76C 'instead':89C 'medical/history':102C 'openemr':71C 'pass':104C 'patient':125C 'patients.med':87C 'patients.rx':91C 'permiss':96C 'prescript':81C,119C,122C,129C 'read':100C 'read-on':99C 'request':93C 'rest':82C 'reus':111C 'rout':84C 'specif':95C 'staff':108C 'tenant':131C 'tenant-wid':130C 'ui':114C 'ui-expos':113C 'user':109C 'uuid':120C 'vulner':78C 'wide':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:40:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124483","severity":null,"published_at":"2026-11-08T14:18:17+00:00","modified_at":"2026-11-08T14:18:17+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102154,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:40:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102155,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-improper-authorization-via-prescription-rest-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}