Authorization Flaw in OpenEMR Affects Patient Data Access

CVE-2026-104136

What is CVE-2026-104136?

OpenEMR, a widely used electronic health records and medical practice management software, contains an authorization bypass vulnerability in its new_recall branch found in the interface/main/messages/save.php file. This issue allows low-privilege authenticated users to access sensitive patient information by exploiting a lack of proper authorization checks on caller-supplied patient identifiers. As a result, attackers could potentially retrieve a range of personal data, including patient contact information and appointment history. This vulnerability has been addressed in version 8.3.0, which institutes necessary patient-level and recall-workflow authorizations to safeguard sensitive information.

References