Session Management Vulnerability in OpenEMR by OpenEMR

CVE-2026-104139

What is CVE-2026-104139?

OpenEMR, a widely used free and open-source electronic health records management application, contains a significant vulnerability that allows any authenticated user to modify the patient identifier in their active session without undergoing proper access control checks. This flaw is located in the library/ajax/set_pt.php file, and it enables low-privilege users to impersonate other patients. Leveraging this vulnerability, an attacker can download sensitive patient documents, including demographics, medical encounters, allergies, medications, and more, despite lacking the necessary access rights. The issue is resolved in version 8.3.0, emphasizing the need for users to upgrade to mitigate risks associated with unauthorized data exposure.

References