CVE-2026-63192: Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

Published Nov 11, 2026

Updated

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.

Affected Software

1 affected component

Bahmni Bahmni-Core=0.93

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bahmni-Core to a version that resolves this vulnerability.
Fixed in 0.93.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:34 AM

Data Sourced

via MITRE·02:34 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires authenticated access to Bahmni-Core. An unauthenticated attacker is not described as being able to exploit the issue.

What information could be exposed?

An authenticated attacker could potentially exfiltrate sensitive data from the database, including patient data stored through Bahmni.

Which version is affected and what version fixes it?

The issue is reported in version 0.93 of the bahmnicore OpenMRS module. It is patched in version 0.93.1.

CVE-2026-63192: Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which version is affected and what version fixes it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which version is affected and what version fixes it?