OpenEMR access control flaws expose patient records
Ordinary staff logins in OpenEMR can peek at patient records.
Summary
Several access-control flaws in OpenEMR, an electronic health records program, let ordinary staff accounts see patient lists, birth dates and parts of clinical records. Versions before 8.3.0 are affected.
Affected when
- Ordinary logged-in staff account
- REST API enabled
- DORN module enabled
- Weno module enabled
What to do
Update OpenEMR to 8.3.0 or later.
Products and platforms
CVE IDs
- CVE-2026-104139 (opens in a new tab)
- CVE-2026-104137 (opens in a new tab)
- CVE-2026-103938 (opens in a new tab)
- CVE-2026-104136 (opens in a new tab)
- CVE-2026-104135 (opens in a new tab)
- CVE-2026-103935 (opens in a new tab)
- CVE-2026-104133 (opens in a new tab)
- CVE-2026-115573 (opens in a new tab)
- CVE-2026-104138 (opens in a new tab)
- CVE-2026-103939 (opens in a new tab)
- CVE-2026-104134 (opens in a new tab)
- CVE-2026-103019 (opens in a new tab)
- CVE-2026-103020 (opens in a new tab)
Sources
- Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen