Is CVE-2026-124480 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124480 being exploited in the wild.

How severe is CVE-2026-124480?

High severity, with a CVSS score of 8.8, published 8 November 2026.

Is there a fix for CVE-2026-124480?

Yes: fixed in 8.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124480 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124480?

Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124480: OpenEMR authorization bypass in FHIR QuestionnaireResponse

CVE-2026-124480 · Severity: high · CVSS 8.8 · Published 2026-11-08

OpenEMR is an electronic health record system that manages patient medical data. A flaw in its FHIR API allows authenticated staff users to read patient questionnaire responses from across the entire system by sending a specific header, potentially exposing private health information for all patients in the organization. An attacker with even low-level staff access can exfiltrate this sensitive data without requiring additional permissions.

Technologies: OpenEMR. Vendors: OpenEMR.

Quick answers

Is CVE-2026-124480 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124480 being exploited in the wild.
How severe is CVE-2026-124480?: High severity, with a CVSS score of 8.8, published 8 November 2026.
Which products and versions are affected?: OpenEMR before 8.4.0.
Is there a fix for CVE-2026-124480?: Yes: fixed in 8.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124480 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124480?: Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.4.0

Technical details

An authorization bypass vulnerability in the FHIR QuestionnaireResponse endpoint (GET /fhir/QuestionnaireResponse) allows authenticated users to bypass scope and patient binding checks by including the APICSRFTOKEN header with a valid session CSRF token. The vulnerability occurs because the presence of the APICSRFTOKEN header causes the request to be marked as a local API request, which bridges the authenticated UI session into the REST stack and skips normal FHIR authorization checks. Low-privileged users (e.g., Accounting staff) can access the api_csrf_token_js value exposed in the UI JavaScript context and reuse it to exfiltrate site-wide questionnaire answer PHI.

Affected products

OpenEMR OpenEMR before 8.4.0

Timeline

2026-09-13: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.