CVE-2026-124482OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch

Descripción

OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and documents through patient-scoped DocumentReference and Binary FHIR endpoints.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-rm4j-gxwp-qh48) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch third-party-advisory