---
id: CVE-2026-104134
title: >-
  OpenEMR: Missing authorization in person-search AJAX leaks patient
  demographics (name, DOB, phone, email)
summary: >-
  OpenEMR is a free and open source electronic health records and medical
  practice management application. Prior to 8.3.0, the search_persons action in
  library/ajax/person_search_ajax.php validates CSRF but does not perform an
  AclMain auth…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: openemr
product: openemr
affected:
  - openemr < 8.3.0
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:03:37.944Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104134'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-xhfm-5pwg-3cxv'
    label: 'https://github.com/openemr/openemr/security/advisories/GHSA-xhfm-5pwg-3cxv'
  - url: 'https://github.com/openemr/openemr/pull/13200'
    label: 'https://github.com/openemr/openemr/pull/13200'
  - url: >-
      https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
    label: >-
      https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
  - url: 'https://github.com/openemr/openemr/releases/tag/v8_3_0'
    label: 'https://github.com/openemr/openemr/releases/tag/v8_3_0'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.692Z'
---

## Overview

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.

## Affected

- `openemr < 8.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.