CVE-2026-124464 OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124464?
CVE-2026-124464 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a patient/QuestionnaireResponse.rs token can request responses by uuid or list the unfiltered bundle to obtain cross-patient clinical assessment answers.
Weakness: CWE-639
Which versions are affected by CVE-2026-124464?
How do I fix CVE-2026-124464?
No fix has been published for CVE-2026-124464 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124464 being exploited?
There is no known exploitation of CVE-2026-124464 in the wild and no public exploit code.
Sources
Also known as GHSA-8x5g-229c-9c6h, GHSA-fmmr-p679-97fq.