CVE-2026-124449
Summary
by MITRE • 11/08/2026
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and questionnaire responses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.