Cross-Site Request Forgery in OpenEMR Billing Module

CVE-2026-103938

What is CVE-2026-103938?

OpenEMR, a free and open-source electronic health records application, has a vulnerability that allows malicious actors to manipulate billing operations through GET requests without validating CSRF tokens. Specifically, prior to version 8.3.0, the application skipped critical form checksum integrity checks when certain parameters were omitted. This oversight can lead to unauthorized voiding of checkouts or regeneration of invoice counters, adversely affecting financial ledgers and audit trails. The issue has been resolved in OpenEMR version 8.3.0, but users of earlier versions are highly advised to upgrade to mitigate these risks.

References