CVE-2026-124480 OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124480?
CVE-2026-124480 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
Weakness: CWE-862
Which versions are affected by CVE-2026-124480?
How do I fix CVE-2026-124480?
No fix has been published for CVE-2026-124480 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124480 being exploited?
There is no known exploitation of CVE-2026-124480 in the wild and no public exploit code.
Sources
Also known as GHSA-5xf2-3h9x-f4m6, GHSA-rq9x-wq7p-vvvq.