CVE-2026-104134: OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the searchpersons action in library/ajax/personsearchajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patientdata tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated OpenEMR user can exploit it. The attacker can query person-search requests using name prefixes and obtain demographic data returned in JSON responses.
Which data may be exposed?
The affected search can disclose patient first and last names, dates of birth, gender, phone numbers, and email addresses. The issue affects searches of the person and patient_data tables.
Are deployments running the fixed version affected?
No. The issue is fixed in OpenEMR version 8.3.0; versions prior to 8.3.0 are affected according to the provided information.
What can be done if an upgrade cannot be performed immediately?
The provided information does not identify a workaround. Limit access for low-privilege authenticated users until the authorization check can be applied through the fixed version.