CVE-2026-124483 OpenEMR before 8.4.0 Improper Authorization via Prescription REST API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124483?
CVE-2026-124483 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.
Weakness: CWE-863
Which versions are affected by CVE-2026-124483?
How do I fix CVE-2026-124483?
No fix has been published for CVE-2026-124483 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124483 exists.
Sources
Also known as GHSA-qrc2-5wvq-f68q, GHSA-vwmc-g4gv-2mf9.