CVE-2026-104135: OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the setpatient branch. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user can exploit it, including users assigned non-clinical roles. The issue does not require elevated privileges.
What information can an attacker obtain?
An attacker can use the set_patient AJAX branch to perform wildcard searches of patient_data and enumerate patient identifiers, full names, and dates of birth.
Are installations affected by default?
The issue is in the payment patient-search AJAX functionality and is exploitable by authenticated users because the affected code checks CSRF tokens but does not perform an AclMain authorization check. The provided data does not identify any configuration prerequisite.
Which versions are affected and what fixes the issue?
OpenEMR versions prior to 8.3.0 are affected. Upgrading to version 8.3.0 fixes the issue.