CVE-2026-104137

In OpenEMR prior to 8.2.0, the fax module (SignalWireClient) decrypts a patient document and writes plaintext bytes under sites/{siteId}/fax, protected only by a predictable uniqid() filename and never removed. An unauthenticated actor who obtains or guesses the URL can retrieve persistent patient documents even with drive encryption enabled.

In OpenEMR before 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers.

In OpenEMR before 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information.

In OpenEMR before 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step.

In OpenEMR before 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters.

In OpenEMR before 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form.

The application OpenEMR versions 5.0.0, 5.0.1-dev and prior is affected by a vertical privilege escalation vulnerability. This vulnerability allows authenticated non-administrator users to view and modify information only accessible to administrators.

OpenEMR versions before 5.0.0 Patch 5 allow unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

OpenEMR version 5.0.0 and prior allows low-privilege users to upload files of dangerous types, which can lead to arbitrary code execution within the context of the vulnerable application.

Prior to 8.4.0, OpenEMR's controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path.