CVE-2026-124449
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and questionnaire responses.