Authentication Bypass in OpenEMR's Pharmacy Module by OpenEMR

CVE-2026-103939

What is CVE-2026-103939?

OpenEMR, a popular open-source electronic health records system, has a vulnerability in its Weno module which allows authenticated users to exploit the absence of access controls and CSRF checks in the file_download.php script. This flaw enables attackers to truncate the 'weno_pharmacy' table and possibly disrupt the pharmacy service by executing unauthorized actions. Specifically, when Weno is enabled, an authenticated attacker can initiate a request that invokes PharmacyService::removeWenoPharmacies(), leaving critical data unavailable. This vulnerability was remedied in version 8.3.0.

References