---
id: CVE-2026-124451
title: >-
  OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in
  SMART on FHIR
summary: >-
  OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its
  SMART on FHIR implementation because checkUserHasAccessToPatient() in
  BearerTokenAuthorizationStrategy.php unconditionally returns true.
  Authenticated users or ma…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: openemr
product: openemr
affected:
  - openemr < 8.4.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T13:15:42.406Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124451'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-xjgw-qjm5-4mq6'
    label: GitHub Security Advisory (GHSA-xjgw-qjm5-4mq6)
  - url: >-
      https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-checkuserhasaccesstopatient-in-smart-on-fhir
    label: >-
      VulnCheck Advisory: OpenEMR before 8.4.0 Authorization Bypass via
      checkUserHasAccessToPatient in SMART on FHIR
tags:
  - cve.org
ingestedAt: '2026-11-08T13:50:34.973Z'
---

## Overview

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind requests to arbitrary patient UUIDs, gaining unauthorized read/write access to other patients' FHIR resources.

## Affected

- `openemr < 8.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.