High priorityDisclosed

Advisory · CVE-2026-124480

OpenEMR FHIR endpoint leaks questionnaire answers for every patient

OpenEMR before 8.4.0 contains an authorization bypass that lets low-privileged authenticated users read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header, reusing the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI, rated high at CVSS 8.8; fixed in 8.4.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124480
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's FHIR doorway is supposed to check that a request is allowed to see a patient's questionnaire answers. A token that the web page itself hands out can be reused to skip that check, so a low-privilege user can pull every patient's answers.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Low-privilege login

    An authenticated low-privilege user logs in.

  2. 02Token reused

    The session-exposed api_csrf_token_js value is copied into the APICSRFTOKEN header.

  3. 03Scope check skipped

    The FHIR scope check is bypassed.

  4. 04Questionnaires fetched

    GET /fhir/QuestionnaireResponse returns cross-patient data.

  5. 05PHI exfiltrated

    Site-wide questionnaire answer data leaves the system.

What happened

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

FHIR is the interoperability doorway, so a bypass there exposes data at site-wide scale rather than one record at a time. The flaw is fixed in OpenEMR 8.4.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.4.0 or later.
  3. Review FHIR access logs for QuestionnaireResponse calls outside expected scopes.
  4. Audit questionnaire answer access for cross-patient reads.
  5. Notify affected patients if bulk access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

A FHIR bypass is a bulk PHI exposure, not a single-record peek. Check the FHIR logs for volume, not just for access.