CVE-2026-102940: OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::changepatient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated OpenEMR user can exploit it. The attacker needs access to a destination patient or category they are permitted to access, but does not need access to the source document, its current patient, or its current category.
Are default deployments affected?
The issue affects OpenEMR versions prior to 8.4.0 because the affected write actions do not enforce the required access checks. Exploitation requires an authenticated account with low-level privileges.
How can administrators tell whether an attempted exploit succeeded?
A final HTTP 403 response is not reliable evidence that the write was prevented. The document reassignment can occur before the later list-rendering authorization check, so administrators should verify whether documents were moved to a different patient or category.
What should be done if patching cannot happen immediately?
The provided information identifies version 8.4.0 as the fix. Until it can be deployed, review and restrict low-privilege authenticated access where possible, and monitor document reassignment activity for unexpected moves between patients or categories.