CVE-2026-124487 OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124487?
CVE-2026-124487 is a high-severity vulnerability in openemr, published on 8 Nov 2026.
Official description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.
Weakness: CWE-863
Which versions are affected by CVE-2026-124487?
How do I fix CVE-2026-124487?
No fix has been published for CVE-2026-124487 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124487 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124487 exists.
Sources
Also known as GHSA-g8pc-cv83-gmcj, GHSA-r79c-4hf6-fgp3.