Access Control Vulnerability in OpenEMR by OpenEMR

CVE-2026-102940

What is CVE-2026-102940?

OpenEMR, a free and open-source electronic health records application, has a vulnerability in its document management functionality. Specifically, prior to version 8.4.0, the system does not adequately verify a low-privilege authenticated user's access rights concerning the source document, patient, and category. This allows such users to reassign documents to other patients or categories that they can access, potentially leading to unauthorized access to sensitive information. The unauthorized reassignment occurs without adequate checks prior to rendering, which means a user can exploit this flaw without triggering immediate access denials. This issue has been addressed in version 8.4.0.

References