Medium severity6.5NVD Advisory· Published Nov 8, 2026

CVE-2026-124464

Description

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a patient/QuestionnaireResponse.rs token can request responses by uuid or list the unfiltered bundle to obtain cross-patient clinical assessment answers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Openemr/Openemrllm-fuzzy
Range: <8.4.0

Patches

Vulnerability mechanics

References

github.com/openemr/openemr/security/advisories/GHSA-fmmr-p679-97fqnvd
www.vulncheck.com/advisories/openemr-before-8.4.0-fhir-patient-compartment-bypass-via-questionnaireresponsenvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000