CSRF Vulnerability in OpenEMR Affecting Medical Document Access

CVE-2026-104138

What is CVE-2026-104138?

OpenEMR, a widely used electronic health records and management application, has a vulnerability allowing low-privilege users to bypass Access Control List (ACL) restrictions. Specifically, endpoints related to report generation do not enforce necessary patient access controls, potentially exposing sensitive clinical documents, including QRDA reports, to unauthorized users. This issue is particularly concerning for clinics managing multiple patients' health information. Users are advised to upgrade to version 8.3.0, where the vulnerability has been addressed.

References