CVE-2026-102940Critical· 9.6▾ AbyssalPoC availableOpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access t…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.
openemr < 8.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104135Medium· 6.5OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
CVE-2026-115573High· 8.1OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
CVE-2026-103939Medium· 5.4OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
CVE-2026-25929Medium· 6.5OpenEMR is a free and open source electronic health records and medical practice management application
CVE-2026-40507Medium· 6.1OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler
CVE-2026-40508Medium· 5.4OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitra…