Authentication Bypass in OpenEMR Affecting Lab Compendium Management

CVE-2026-104133

What is CVE-2026-104133?

OpenEMR, the open-source electronic health records and medical practice management application, has a vulnerability that arises from insufficient enforcement of access control lists (ACLs) in its DORN module. This allows low-privilege authenticated users to exploit the lab management functionality by supplying a specific labGuid, potentially leading to the unintended deletion of critical lab-order configuration details. Such actions could disrupt lab ordering processes, necessitating administrative intervention to restore normal operations. A patch has been made available in version 8.3.0 to mitigate this concern, ensuring robust access control to safeguard sensitive medical configurations.

References