CVE-2026-104135Medium· 6.5▾ TwilightPoC availableOpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104134Medium· 6.5OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
CVE-2026-104138Medium· 6.5OpenEMR: Missing authorization on QRDA Category I/III download endpoints
CVE-2026-104133High· 7.1OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
CVE-2026-104139Medium· 6.5OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
CVE-2026-104137High· 7.1OpenEMR: Patient Data Search Without Sufficient ACL
CVE-2026-115573High· 8.1OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration