Skip to content
Threat Feed
Subscribe
high advisory

OpenEMR: FHIR API authorization bypass (CVE-2026-124480)

OpenEMR versions before 8.4.0 contain an authorization bypass vulnerability allowing authenticated users to exfiltrate cross-patient questionnaire data via the FHIR API.

CVE search metadata

CVE search record: CVE-2026-124480. Severity: high. CVSS: 8.8. KEV: no. Product: OpenEMR (< 8.4.0). Brief: OpenEMR: FHIR API authorization bypass (CVE-2026-124480). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-18ffda42/

Triage facts

Revision 1
Applicability
OpenEMR (< 8.4.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 8, 15:36 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability in the FHIR API implementation. Authenticated users with low privileges can bypass FHIR scope restrictions by reusing the 'api_csrf_token_js' value from a session in an 'APICSRFTOKEN' HTTP header. This enables unauthorized access to cross-patient 'QuestionnaireResponse' data, leading to the potential exfiltration of sensitive protected health information (PHI) via the 'GET /fhir/QuestionnaireResponse' endpoint.

Impact

Successful exploitation allows low-privileged users to exfiltrate site-wide PHI contained within FHIR QuestionnaireResponse objects, bypassing existing scope controls.

Recommendation

  • Upgrade to OpenEMR 8.4.0 or later to remediate the authorization logic in the FHIR API.
  • Audit access logs for the 'GET /fhir/QuestionnaireResponse' endpoint to identify patterns of unauthorized enumeration by low-privileged accounts.

Immediate actions

Patch OpenEMR to version 8.4.0

IT Operations 48h

Threat Hunt

Analyze web server logs for GET /fhir/QuestionnaireResponse requests associated with unusual account activity or unexpected use of APICSRFTOKEN

T1537 high high confidence hunt now

Data: webserver access logs

Mitigations

Upgrade to OpenEMR 8.4.0

immediate IT Operations

CVE-2026-124480

Detection coverage 1

Detect CVE-2026-124480 Exploitation - Unauthorized FHIR API Access

high

Detects exploitation of CVE-2026-124480 by identifying requests to the FHIR QuestionnaireResponse endpoint that include the suspicious APICSRFTOKEN header.

sigma tactics: exfiltration techniques: T1537 sources: webserver

Detection queries are available on the platform. Get full rules →