CVE-2026-104139

The application OpenEMR versions 5.0.0, 5.0.1-dev and prior is affected by a vertical privilege escalation vulnerability. This vulnerability allows authenticated non-administrator users to view and modify information only accessible to administrators.

OpenEMR versions before 5.0.0 Patch 5 allow unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

OpenEMR version 5.0.0 and prior allows low-privilege users to upload files of dangerous types, which can lead to arbitrary code execution within the context of the vulnerable application.

Prior to 8.4.0, OpenEMR's controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path.

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.

In OpenEMR prior to 8.2.0, the fax module (SignalWireClient) decrypts a patient document and writes plaintext bytes under sites/{siteId}/fax, protected only by a predictable uniqid() filename and never removed. An unauthenticated actor who obtains or guesses the URL can retrieve persistent patient documents even with drive encryption enabled.

In OpenEMR before 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers.

In OpenEMR before 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL. They also accept an unscoped report_id, allowing a low-privilege user to download QRDA Category One and Three documents for patients in a measure.

In OpenEMR before 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information.

In OpenEMR before 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information.