CVE-2026-124483

Summary

OpenEMR before 8.4.0 has an authorization flaw where prescription API endpoints incorrectly validate access using the patients.med ACL instead of patients.rx, allowing users with read-only medical history permissions to perform write operations on prescriptions. This enables authenticated low-privilege users to enumerate, forge, and deactivate prescriptions across all patients in the tenant.

Exploitability

Exploitation requires only a valid authenticated session with minimal privileges (e.g., read-only Medical/History access) and reuse of the UI-exposed APICSRFTOKEN, making it straightforward for insider threats or compromised low-privilege accounts.

Blast radius

Successful exploitation allows tenant-wide prescription manipulation, risking patient safety through incorrect medication orders, data integrity loss, and potential regulatory violations under HIPAA.

Detection

Defenders should monitor REST API logs for non-administrative users making POST/PUT/DELETE requests to /api/prescription endpoints; look for repeated prescription UUID enumeration (e.g., sequential GET /api/prescription calls) or unexpected prescription creation/deactivation by users lacking patients.rx ACL permissions. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenEMR 8.4.0 or later, which corrects the ACL check to enforce patients.rx permissions for prescription API routes.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.