Access Control Vulnerability in OpenEMR by OpenEMR

CVE-2026-104137

What is CVE-2026-104137?

OpenEMR, a widely used electronic health records application, has a vulnerability that allows low-privilege users to access sensitive patient information through the sms_search branch of the interface. Specifically, prior to version 8.3.0, the save.php file did not enforce adequate patient or feature-level Access Control Lists (ACLs) for authenticated sessions. As a result, users without direct access to patient data could exploit the MedEx SMS endpoint to obtain patient identifiers, names, phone numbers, SMS permission status, and recent message logs. This issue has been addressed in version 8.3.0, emphasizing the importance of regular updates to maintain data security.

References