{"id":"CVE-2026-124487","kind":"vulnerability","aliases":["CVE-2026-124487"],"related":[],"title":"OpenEMR: low-privilege users can pull any patient's full clinical record","description":"OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.","summary":"OpenEMR before 8.4.0 lets a user with only demographics and documents permissions generate a CCDA for any patient through the non-patient /fhir/DocumentReference/$docref route. The attacker can then download the full-chart CCDA and extract clinical data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fhir","healthcare","openemr","vendor"],"not_affected_if":["version-8.4.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed release in the product ranges.","fix":"- OpenEMR: move to `8.4.0` or later.","status":"open","published_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","triaged_at":"2026-11-08T14:49:25+00:00","updated_at":"2026-11-08T14:49:25+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-08T14:49:25Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later.","reach":"network","title":"OpenEMR: low-privilege users can pull any patient's full clinical record","impact":"high","summary":"OpenEMR before 8.4.0 lets a user with only demographics and documents permissions generate a CCDA for any patient through the non-patient /fhir/DocumentReference/$docref route. The attacker can then download the full-chart CCDA and extract clinical data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["openemr","healthcare","fhir"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege user reads any patient's full clinical chart","analyst_note":"Confirm the affected version range and whether the FHIR route is exposed by default, using the NVD page and the vendor advisory on github.com.","how_to_check":"- Check the installed OpenEMR version against the fixed release in the product ranges.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.4.0-or-later"],"who_is_affected":"Any OpenEMR deployment before 8.4.0 where some accounts hold demographics and documents permissions is exposed, because the flawed route does not check whether the user may access the requested patient. Deployments already on 8.4.0 or later are not affected by this flaw. The sources do not say whether the route is reachable from the internet by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4619,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124487':16A,19A '-2026':15A,18A '/fhir/documentreference':47B,78C '8.4.0':26B,66C 'allow':82C 'attack':51B,93C 'author':70C 'ccda':38B,59B,92C,112C 'chart':58B,111C 'clinic':12A,62B,118C 'contain':67C 'cve':14A,17A 'data':63B,119C 'demograph':32B,96C 'docref':48B,79C 'document':34B,98C,115C 'download':54B,107C 'exfiltr':117C 'extract':61B 'fhir':20B 'full':11A,57B,110C 'full-chart':56B,109C 'generat':36B,88C 'healthcar':21B 'improp':69C 'let':27B 'low':3A,84C 'low-privileg':2A,83C 'non':45B,75C 'non-pati':44B,74C 'openemr':1A,22B,24B,64C 'paramet':105C 'patient':9A,41B,46B,76C,90C,104C,114C 'permiss':35B,99C 'post':77C 'privileg':4A,85C 'pull':7A 'record':13A 'rout':49B,80C 'suppli':101C 'user':5A,29B,86C 'vendor':23B 'victim':103C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.4.0 where some accounts hold demographics and documents permissions is exposed, because the flawed route does not check whether the user may access the requested patient. Deployments already on 8.4.0 or later are not affected by this flaw. The sources do not say whether the route is reachable from the internet by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fhir","healthcare","high","openemr","vendor"],"campaign_type":null,"search_a":"'-124487':16A,19A '-2026':15A,18A 'clinic':12A 'cve':14A,17A 'full':11A 'low':3A 'low-privileg':2A 'openemr':1A 'patient':9A 'privileg':4A 'pull':7A 'record':13A 'user':5A","search_b":"'/fhir/documentreference':47B '8.4.0':26B 'attack':51B 'ccda':38B,59B 'chart':58B 'clinic':62B 'data':63B 'demograph':32B 'docref':48B 'document':34B 'download':54B 'extract':61B 'fhir':20B 'full':57B 'full-chart':56B 'generat':36B 'healthcar':21B 'let':27B 'non':45B 'non-pati':44B 'openemr':22B,24B 'patient':41B,46B 'permiss':35B 'rout':49B 'user':29B 'vendor':23B","search_c":"'/fhir/documentreference':78C '8.4.0':66C 'allow':82C 'attack':93C 'author':70C 'ccda':92C,112C 'chart':111C 'clinic':118C 'contain':67C 'data':119C 'demograph':96C 'docref':79C 'document':98C,115C 'download':107C 'exfiltr':117C 'full':110C 'full-chart':109C 'generat':88C 'improp':69C 'low':84C 'low-privileg':83C 'non':75C 'non-pati':74C 'openemr':64C 'paramet':105C 'patient':76C,90C,104C,114C 'permiss':99C 'post':77C 'privileg':85C 'rout':80C 'suppli':101C 'user':86C 'victim':103C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-13T09:38:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124487","severity":null,"published_at":"2026-11-08T14:18:18+00:00","modified_at":"2026-11-08T14:18:18+00:00","first_seen_at":"2026-11-08T14:48:41+00:00","fetched_at":"2026-11-08T14:48:41+00:00","note":null}],"documents":[{"id":102162,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r79c-4hf6-fgp3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:38:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102163,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-improper-authorization-in-fhir-documentreference-docref","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}