CVE-2026-124451

CVSS 6.0 (medium) · published 2026-11-08

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.

Weakness: CWE-639

Source: NVD CVE-2026-124451

References

• https://github.com/openemr/openemr/security/advisories/GHSA-xjgw-qjm5-4mq6
• https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-checkuserhasaccesstopatient-in-smart-on-fhir

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.