CVE-2026-124451 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.
If you want to get best quality of vulnerability data, you may have to visit VulDB.