CVE-2026-124480

Summary

OpenEMR versions before 8.4.0 suffer from an authorization bypass where low-privileged authenticated users can access cross-patient FHIR QuestionnaireResponse data by reusing a session-exposed CSRF token to bypass scope checks. This allows unauthorized exfiltration of sensitive PHI stored in questionnaire answers across the entire site.

Exploitability

Exploitation requires only a valid low-privileged user session and knowledge of the APICSRFTOKEN header usage; the api_csrf_token_js value is exposed client-side, making exploitation straightforward for authenticated attackers.

Blast radius

Successful exploitation enables any compromised or insider low-privilege user to read all site-wide FHIR QuestionnaireResponse records, potentially exposing PHI for every patient in the system.

Detection

Defenders should monitor server logs for GET requests to /fhir/QuestionnaireResponse that include the APICSRFTOKEN header from users lacking appropriate FHIR scope permissions; anomalous access patterns where non-administrative users retrieve QuestionnaireResponse resources for patients outside their assigned care teams are indicative of exploitation.

Prioritized remediation

Upgrade to OpenEMR 8.4.0 or later, which patches the authorization bypass by enforcing proper FHIR scope validation independent of CSRF token presence.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.