High priorityDisclosed

Advisory · CVE-2026-124483

OpenEMR prescription API checks the wrong permission, letting staff forge prescriptions

OpenEMR before 8.4.0 contains an incorrect authorization flaw because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check, letting authenticated staff users reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide, rated high at CVSS 8.7 under version 4.0; fixed in 8.4.0.

Advisory published November 8, 2026Independent summary
Vendor
OpenEMR
Product
OpenEMR
Identifier / CWE
CVE-2026-124483
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

OpenEMR's prescription doorway checks whether you can view medical history instead of whether you can write prescriptions. Anyone with read-only access passes, and can then invent prescriptions for any patient or switch off real ones.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Staff login

    An authenticated staff user with read-only Medical/History access logs in.

  2. 02Wrong ACL checked

    The prescription REST API checks patients.med instead of patients.rx.

  3. 03Token reused

    The UI-exposed APICSRFTOKEN is sent with the request.

  4. 04Prescriptions enumerated

    Prescription UUIDs are listed for arbitrary patients.

  5. 05Prescriptions forged

    New prescriptions are created and existing ones deactivated tenant-wide.

What happened

OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, low privileges required, and no user interaction.

Forged prescriptions are a patient safety event, not just a data event, and deactivated prescriptions can interrupt real treatment. The flaw is fixed in OpenEMR 8.4.0.

What to do

  1. Inventory OpenEMR deployments and record each version.
  2. Upgrade to OpenEMR 8.4.0 or later.
  3. Review prescription API logs for creations and deactivations outside normal workflows.
  4. Audit prescriptions for entries that do not match the prescribing clinician.
  5. Reconcile active prescriptions with clinicians and notify affected patients.
  6. Verify the deployed version after updating.

Management note

Forged or cancelled prescriptions can harm patients directly. Reconcile the prescription list with the clinicians before anything else.