---
id: "CVE-2026-124483"
page: "https://infrastack.ai/live/CVE-2026-124483"
kind: "vulnerability"
aliases: ["CVE-2026-124483"]
title: "OpenEMR: read-only staff can forge and deactivate prescriptions"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "rest-api", "self-hosted"]
not_affected_if: ["no-rest-api-exposure", "openemr-8.4.0-or-later"]
published_at: "2026-11-08T14:18:17+00:00"
first_seen_at: "2026-11-08T14:48:41+00:00"
updated_at: "2026-11-08T14:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124483", "first_seen_at": "2026-11-08T14:48:41+00:00"}]
exploit_sources: []
---

# OpenEMR: read-only staff can forge and deactivate prescriptions

Link for people: https://infrastack.ai/live/CVE-2026-124483 (this .md is for agents)

OpenEMR before 8.4.0 checks the wrong access control on its prescription REST API, so staff with read-only medical history access pass the check. Those users can enumerate prescription IDs, create forged prescriptions for any patient, and deactivate existing prescriptions across the whole tenant.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenEMR version against the fixed release in the product ranges; unknown if the sources do not give a product range.
- Review which staff accounts hold read-only Medical/History access and whether they use the prescription REST API.

## Fix

- OpenEMR: move to `8.4.0` or later (per the advisory title, the fix is in 8.4.0).

## Timeline

- 2026-11-08T14:48:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124483

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.4.0-improper-authorization-via-prescription-rest-api

## From the sources

OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_