NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-124480 — Openemr

HIGH

CVE-2026-124480 is a high-severity (CVSS 8.8) CWE-862 vulnerability in openemr openemr. A fix is available — see the affected versions and patch details below.

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

Affected Products

1 product · 1 configurations
Application
openemropenemr
< 8.4.0
1 version
0

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every openemr openemr deployment and check each version against the affected-products list above.

  2. Fix

    Apply the openemr openemr security patch or hotfix for CVE-2026-124480 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
O3 Security · Runtime Protection

Is CVE-2026-124480 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works