CVE-2026-104136: OpenEMR: Arbitrary Patient Recall and Contact Detail Read
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege authenticated OpenEMR user can exploit it. The user must know or be able to enumerate a patient identifier.
What information can be exposed?
An attacker can retrieve patient details and contact fields, HIPAA notification preferences, recent appointment information, and existing recall information.
Are systems running the fixed release affected?
No. The issue affects OpenEMR versions prior to 8.3.0 and is fixed in version 8.3.0.
How can I assess whether my deployment is exposed?
Check whether the OpenEMR instance is running a version earlier than 8.3.0. On affected versions, assess whether low-privilege authenticated accounts can access the new_recall workflow and supply or enumerate patient identifiers.