OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in the OnsitePortalActivityController::Update() function. This flaw allows authenticated portal patients to manipulate the patientId parameter in PUT requests to the onsiteportalactivity API, enabling them to access and modify other patients' activity records. Exploitation can lead to disclosure of sensitive data, overwriting of narratives and status fields, and unauthorized ownership takeover of records.
OpenEMR versions prior to 8.3.0 contain a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions. This flaw allows authenticated low-privilege users to read and overwrite arbitrary files on the server by exploiting an unsanitized file_path parameter. Attackers can download sensitive files such as database credentials or overwrite writable files with arbitrary content. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions from 7.0.1 up to but not including 8.4.0 have a vulnerability in the OneTimeAuth.php component where authentication tokens are not properly revoked and PIN checks lack rate limiting and strict comparison. This flaw allows attackers who have captured a token to replay it or brute-force the PIN to access patient portal sessions, potentially exposing protected health information (PHI).
OpenEMR versions prior to 8.4.0 contain a SQL injection vulnerability in the patient portal's OnsiteDocument query API. Authenticated users can exploit this flaw by injecting SQL through bitwise criteria filter parameters, allowing unauthorized reading of any database table, including sensitive patient and staff data. The vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability in the document management controller. Low-privilege authenticated users can reassign documents to patients or categories they have access to without proper verification, allowing unauthorized access to sensitive medical records. This flaw is fixed in version 8.4.0.
OpenEMR versions from 6.0.0 up to but not including 8.3.0 contain a vulnerability where an unauthenticated parameter is used to load user settings before authentication. This allows remote attackers to enumerate valid usernames by observing timing or page differences. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a vulnerability where the admin.php multisite administration page is accessible without authentication. This page exposes sensitive information including site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links to unauthenticated network actors. The issue is resolved in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an open redirect vulnerability in the userSessionLogout() function of the AuthorizationController.php file. This occurs because the id_token_hint parameter is processed without signature verification, and when a trusted session is missing, the application redirects to a user-supplied post_logout_redirect_uri without validating it against registered client redirect URIs. This allows unauthenticated attackers to craft logout links that redirect users to arbitrary external sites, potentially facilitating phishing attacks. The vulnerability is fixed in OpenEMR version 8.3.0.
CVE-2026-104134 is a missing authorization vulnerability in OpenEMR prior to version 8.3.0. The flaw exists in the search_persons action of library/ajax/person_search_ajax.php, where CSRF validation is performed but no ACL authorization check is done. This allows a low-privilege authenticated user to query patient data and retrieve sensitive personal information such as names, dates of birth, gender, phone numbers, and email addresses. The issue is fixed in OpenEMR version 8.3.0.
CVE-2026-103939 is a missing authorization vulnerability in OpenEMR versions prior to 8.3.0 affecting the Weno module. The file_download.php script lacks access control and CSRF protections, allowing any authenticated user to truncate the weno_pharmacy table. This can also be triggered via cross-site requests through a logged-in victim, potentially emptying the e-prescribing pharmacy directory and causing availability issues. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in several custom report download endpoints. These endpoints validate CSRF tokens but do not enforce patient or medical access control lists (ACLs), allowing low-privilege authenticated users to access clinical quality measure (CQM) report generation and download functions for reports they should not have access to. This can expose sensitive QRDA Category One and Category Three clinical documents. The issue is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in the controller dispatch mechanism. This flaw allows low-privilege authenticated users to access administrative functions without proper permission checks, including modifying insurance-routing hosts and credentials and enumerating patient information. The issue is resolved in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in the DORN module. A low-privilege authenticated user can exploit this flaw to delete and deactivate lab-ordering configuration data, potentially corrupting the system and requiring administrator intervention to restore. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability in two PHP form scripts. Authenticated clinical users can inject malicious event-handler markup by submitting crafted input containing double quotes, which escapes HTML attribute boundaries. This can lead to exposure of session data and protected health information or unauthorized patient-record actions when another clinician views the affected form. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an improper access control vulnerability in the new_recall branch of interface/main/messages/save.php. This flaw allows low-privilege authenticated users to supply arbitrary patient identifiers (pid) without proper authorization checks, enabling them to access sensitive patient details, contact information, HIPAA notification preferences, recent appointments, and recall data. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the pos_checkout_ippf.php interface. This flaw allows state-changing operations such as voiding transactions or regenerating invoice counters through GET requests without proper CSRF token validation. The conditional form_checksum integrity check can be bypassed when a specific parameter is omitted, enabling an attacker to force an authenticated billing user to perform unauthorized actions. This vulnerability affects financial and audit records integrity. The issue is resolved in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an improper access control vulnerability in the sms_search branch of interface/main/messages/save.php. This flaw allows low-privilege authenticated users to access patient identifiers, names, phone numbers, SMS permission status, and recent message information without proper patient or feature-level access control enforcement. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability (CWE-862) in the handling of patient identifiers within session data. This flaw allows any authenticated user with low privileges to set an arbitrary patient identifier in their session and subsequently download sensitive patient documents without proper access control. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.2.0 contain a vulnerability where patient documents are stored with predictable filenames in a publicly accessible location. This allows unauthenticated actors who can guess or obtain the URL to access sensitive patient documents. The issue is fixed in version 8.2.0.