CSRF Vulnerability in OpenEMR Affects Patient Data Access

CVE-2026-104135

What is CVE-2026-104135?

The vulnerability in OpenEMR allows authenticated users, including those with non-clinical roles, to access sensitive patient information without proper authorization checks. Specifically, the issue arises in the payment_ajax.php file, which performs CSRF token validation but neglects to enforce ACL (Access Control List) authorization, leading to potential enumeration of patient identifiers, full names, and dates of birth through the set_patient branch. This security flaw underscores the importance of robust authorization mechanisms in sensitive applications, especially those handling health records.

References