CVE-2026-104139: OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patientfile/downloadtemplate.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0.