CSRF Bypass Vulnerability in OpenEMR Affects User Data Privacy

CVE-2026-104134

What is CVE-2026-104134?

OpenEMR, a widely used electronic health records management solution, is susceptible to a security flaw that allows low-privilege authenticated users to gain unauthorized access to sensitive patient information. Specifically, prior to version 8.3.0, the application fails to enforce proper ACL (Access Control List) checks during the search_persons action. This oversight permits attackers to use CSRF tactics to enumerate name prefixes, yielding potentially harmful data such as patients' names, birth dates, genders, phone numbers, and email addresses. The issue has since been addressed and resolved in version 8.3.0 of OpenEMR.

References