CVE-2026-124482OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch

Açıklama

OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and documents through patient-scoped DocumentReference and Binary FHIR endpoints.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-rm4j-gxwp-qh48) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch third-party-advisory