CVE-2026-124480 in OpenEMR
Summary
by MITRE • 11/08/2026
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in OpenEMR versions prior to 8.4.0 represents a critical authorization bypass within the application's Fast Healthcare Interoperability Resources (FHIR) API implementation. This flaw specifically affects low-privileged authenticated users, allowing them to access sensitive cross-patient data that should be strictly restricted by role-based access controls and patient-specific scopes. The core technical issue lies in how the server validates incoming requests against the defined FHIR scope permissions. Instead of enforcing strict validation on every request parameter or resource identifier, the application relies heavily on a specific header mechanism for CSRF protection which inadvertently serves as an authorization gatekeeper that can be manipulated.
The exploitation vector centers on the APICSRFTOKEN header and its associated JavaScript variable api_csrf_token_js. In normal operation, this token is intended to prevent Cross-Site Request Forgery attacks by ensuring that state-changing requests originate from legitimate user sessions within the application context. However, in versions before 8.4.0, the server-side logic incorrectly treats the presence of a valid APICSRFTOKEN as sufficient proof of authorization for FHIR resources. This design flaw allows an attacker to bypass the intended scope checks by simply reusing or forging this token value from their own session context. By sending a GET request to /fhir/QuestionnaireResponse with the appropriate header, the server fails to verify whether the requesting user has permission to view the specific QuestionnaireResponse data being requested.
The operational impact of this vulnerability is severe due to the nature of the exposed data. FHIR QuestionnaireResponses contain detailed answers to medical questionnaires filled out by patients. These responses often include Protected Health Information (PHI) such as symptoms, lifestyle habits, mental health history, and other sensitive personal details. Because the bypass allows for cross-patient access, an attacker with low-level privileges can systematically enumerate and exfiltrate PHI from multiple patients across the entire site. This constitutes a significant breach of patient privacy and violates regulatory compliance standards such as HIPAA in the United States or GDPR in Europe, potentially leading to severe legal repercussions and loss of trust for healthcare providers using the platform.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing restrictive access control lists on sensitive data objects. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials but exploits flawed logic to escalate privileges or access unauthorized resources. The specific mechanism of bypassing scope checks via token reuse is a form of Broken Object Level Authorization (BOLA), which falls under CWE-639 Injection and related access control flaws in web applications.
To mitigate this vulnerability, organizations running OpenEMR must immediately upgrade to version 8.4.0 or later where the authorization logic has been corrected to properly validate FHIR scopes independent of CSRF token presence. For environments that cannot be upgraded instantly, a temporary mitigation involves implementing strict server-side validation rules that ensure every request to /fhir/QuestionnaireResponse explicitly checks the user's role and patient association against the requested resource ID before returning data. Additionally, security teams should audit API endpoints for similar patterns where authentication tokens are conflated with authorization decisions, ensuring that access control lists are enforced at a granular level regardless of session validity or token presence.