CVE-2026-124458 OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124458?
CVE-2026-124458 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's demographics by bypassing compartment enforcement. Attackers holding a patient SMART token with patient/Person.read can harvest staff Person UUIDs from Appointment references to retrieve names, home addresses, phone numbers, and personal emails.
Weakness: CWE-284
Which versions are affected by CVE-2026-124458?
How do I fix CVE-2026-124458?
No fix has been published for CVE-2026-124458 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124458 being exploited?
There is no known exploitation of CVE-2026-124458 in the wild and no public exploit code.
Sources
Also known as GHSA-ggpx-qgcr-w2gh, GHSA-hh44-mqpq-84jh.