OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
Affects OpenEMR versions before 8.4.0, where a low-privileged staff session can reach site-wide questionnaire answers through the FHIR API. Fixed in 8.4.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 8.4.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Attacker has an authenticated core UI session (low-privileged staff account). Request carries the APICSRFTOKEN header, which the bypass treats as marking the request as local. The GET /fhir/QuestionnaireResponse route runs without an authorization check wrapper.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Attacker has an authenticated core UI session (low-privileged staff account). Request carries the APICSRFTOKEN header, which the bypass treats as marking the request as local. The GET /fhir/QuestionnaireResponse route runs without an authorization check wrapper.Upgrade to a fixed version: 8.4.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- openemr openemr
fixed in 8.4.0
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-124480
Is CVE-2026-124480 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The FHIR QuestionnaireResponse read route runs without an authorization check, and sending the APICSRFTOKEN header causes the server to treat the request as local. A low-privileged staff browser session, or same-origin script running in one, can therefore read questionnaire answers containing patient health information across patients.Source: github.com
Which versions are affected by CVE-2026-124480?
openemr: before 8.4.0.Source: cve.now feed data
Am I affected, and how do I check?
OpenEMR versions before 8.4.0 are listed as affected, from the earliest release onward. The bug needs an authenticated core UI staff session, so compare the installed OpenEMR version against 8.4.0 to see whether a given installation falls in the affected range.Source: github.com
How do I fix CVE-2026-124480?
Upgrade OpenEMR to 8.4.0, which is the fixed version named in the sources.Source: github.com