OpenEMR: Incorrect authorization in prescription REST API (CVE-2026-124483)

OpenEMR versions before 8.4.0 contain an incorrect authorization vulnerability in the prescription REST API. The API improperly validates requests by checking the patients.med ACL instead of the intended patients.rx ACL and fails to verify required permission bits. This allows an authenticated staff user with basic read-only access to perform unauthorized actions, including the enumeration of prescription UUIDs, the forging of prescriptions for any patient, and the deactivation of existing prescriptions across the system.

Impact

Successful exploitation allows authenticated staff users to manipulate prescription data, which could result in unauthorized medical prescriptions or the disruption of existing patient care. The scope of the vulnerability is tenant-wide.

Recommendation

• Upgrade OpenEMR to version 8.4.0 or later to apply the fix for CVE-2026-124483.
• Until patching is complete, audit access logs for high-frequency or unauthorized access to prescription REST API endpoints by users who do not require such access for their roles.