CVE-2026-115573High· 8.1▾ MidnightPoC availableOpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers that were intended to be reached through ACL-gated Practice Settings routes. This issue is fixed in version 8.3.0.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104135Medium· 6.5OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
CVE-2026-103939Medium· 5.4OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
CVE-2026-104134Medium· 6.5OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
CVE-2026-104138Medium· 6.5OpenEMR: Missing authorization on QRDA Category I/III download endpoints
CVE-2026-104133High· 7.1OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
CVE-2026-104139Medium· 6.5OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI