{"id":"CVE-2026-124480","published":"2026-11-08T14:18:17.147","lastModified":"2026-11-10T21:46:35.670","description":"OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-fhir-questionnaireresponse-apicsrftoken","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR versions before 8.4.0 suffer from an authorization bypass where low-privileged authenticated users can access cross-patient FHIR QuestionnaireResponse data by reusing a session-exposed CSRF token to bypass scope checks. This allows unauthorized exfiltration of sensitive PHI stored in questionnaire answers across the entire site.","exploitability":"Exploitation requires only a valid low-privileged user session and knowledge of the APICSRFTOKEN header usage; the api_csrf_token_js value is exposed client-side, making exploitation straightforward for authenticated attackers.","blast_radius":"Successful exploitation enables any compromised or insider low-privilege user to read all site-wide FHIR QuestionnaireResponse records, potentially exposing PHI for every patient in the system.","remediation":"Upgrade to OpenEMR 8.4.0 or later, which patches the authorization bypass by enforcing proper FHIR scope validation independent of CSRF token presence.","detection":"Defenders should monitor server logs for GET requests to /fhir/QuestionnaireResponse that include the APICSRFTOKEN header from users lacking appropriate FHIR scope permissions; anomalous access patterns where non-administrative users retrieve QuestionnaireResponse resources for patients outside their assigned care teams are indicative of exploitation.","tags":["auth-bypass","fhir","phiproxy","csrf-token-reuse","openemr"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:40.875Z"}}