{"id":"CVE-2026-124451","title":"OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR","summary":"OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or ma…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"openemr","product":"openemr","affected":["openemr < 8.4.0"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T13:15:42.406Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-124451","references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xjgw-qjm5-4mq6","label":"GitHub Security Advisory (GHSA-xjgw-qjm5-4mq6)"},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-checkuserhasaccesstopatient-in-smart-on-fhir","label":"VulnCheck Advisory: OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T13:50:34.973Z","slug":"CVE-2026-124451","body":"## Overview\n\nOpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.\n\n## Affected\n\n- `openemr < 8.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}