{"id":"CVE-2026-124483","published":"2026-11-08T14:18:17.617","lastModified":"2026-11-10T21:46:25.580","description":"OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-improper-authorization-via-prescription-rest-api","tags":[]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q","tags":[]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-qrc2-5wvq-f68q","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.4.0 has an authorization flaw where prescription API endpoints incorrectly validate access using the patients.med ACL instead of patients.rx, allowing users with read-only medical history permissions to perform write operations on prescriptions. This enables authenticated low-privilege users to enumerate, forge, and deactivate prescriptions across all patients in the tenant.","exploitability":"Exploitation requires only a valid authenticated session with minimal privileges (e.g., read-only Medical/History access) and reuse of the UI-exposed APICSRFTOKEN, making it straightforward for insider threats or compromised low-privilege accounts.","blast_radius":"Successful exploitation allows tenant-wide prescription manipulation, risking patient safety through incorrect medication orders, data integrity loss, and potential regulatory violations under HIPAA.","remediation":"Upgrade to OpenEMR 8.4.0 or later, which corrects the ACL check to enforce patients.rx permissions for prescription API routes.","detection":"Defenders should monitor REST API logs for non-administrative users making POST/PUT/DELETE requests to /api/prescription endpoints; look for repeated prescription UUID enumeration (e.g., sequential GET /api/prescription calls) or unexpected prescription creation/deactivation by users lacking patients.rx ACL permissions. No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","web-api","healthcare","misconfiguration"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:56:04.946Z"}}