---
id: CVE-2026-104137
title: 'OpenEMR: Patient Data Search Without Sufficient ACL'
summary: >-
  OpenEMR is a free and open source electronic health records and medical
  practice management application. Prior to 8.3.0, the sms_search branch of
  interface/main/messages/save.php requires an authenticated session but does
  not enforce pat…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-284
vendor: openemr
product: openemr
affected:
  - openemr < 8.3.0
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:56:13.510Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104137'
references:
  - url: 'https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv'
    label: 'https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv'
  - url: 'https://github.com/openemr/openemr/pull/13200'
    label: 'https://github.com/openemr/openemr/pull/13200'
  - url: >-
      https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
    label: >-
      https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
  - url: 'https://github.com/openemr/openemr/releases/tag/v8_3_0'
    label: 'https://github.com/openemr/openemr/releases/tag/v8_3_0'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.606Z'
---

## Overview

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

## Affected

- `openemr < 8.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.