CVE-2026-104137: OpenEMR: Patient Data Search Without Sufficient ACL
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege OpenEMR user can exploit it, including a user who is unable to access patient data through the normal interface. No user interaction is required.
What information can be exposed?
The MedEx SMS search endpoint can disclose patient identifiers, names, phone numbers, SMS permission status, and recent message information.
Are default access controls sufficient to prevent exploitation?
No. The affected sms_search branch requires an authenticated session but does not enforce patient-level or feature-level ACLs, allowing users without normal patient-data access to query it.
Which versions are affected and what is the remediation?
OpenEMR versions prior to 8.3.0 are affected. Upgrade to version 8.3.0, which includes the fix.