CVE-2026-124451Medium· 5.3▾ SunlitOpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or ma…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.
openemr < 8.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124447High· 8.1OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
CVE-2026-124449Medium· 6.5OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes
CVE-2026-124453High· 7.1OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php
CVE-2026-124455Medium· 6.5OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment
CVE-2026-124460Medium· 6.5OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController
CVE-2026-124459High· 8.1OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers