CVE-2026-124487 · Vendor
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 lets a user with only demographics and documents permissions generate a CCDA for any patient through the non-patient /fhir/DocumentReference/$docref route. The attacker can then download the full-chart CCDA and extract clinical data.
first public Sep 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any OpenEMR deployment before 8.4.0 where some accounts hold demographics and documents permissions is exposed, because the flawed route does not check whether the user may access the requested patient. Deployments already on 8.4.0 or later are not affected by this flaw. The sources do not say whether the route is reachable from the internet by default.
Not affected if version-8.4.0-or-later
Who cares fhir, healthcare, openemr
8.4.0 or later.OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.