GHSA-89j2-7cg2-mm93: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

Q: Which OpenEMR versions are affected?

OpenEMR versions before 8.3.0 are affected. The provided information does not identify any affected 8.3.0 or later release.

Q: Does exploitation require an existing account?

Yes. An attacker needs to be authenticated as a low-privilege user; no user interaction is required.

Q: What can an attacker do after exploiting the issue?

They can recategorize documents belonging to other patients, retrieve those documents with an empty patient_id, exfiltrate PHI, and tamper with patient charts.

Published Nov 8, 2026

Updated

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke moveactionprocess to move a document into a patients|demo category, then retrieve it with an empty patientid to exfiltrate PHI and tamper with charts.

Affected Software

1 affected component

OpenEMR OpenEMR<8.3.0

Event History

Nov 8, 2026

CVE Published

via OSV·01:16 PM

Data Sourced

via OSV·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenEMR versions are affected?

OpenEMR versions before 8.3.0 are affected. The provided information does not identify any affected 8.3.0 or later release.

Does exploitation require an existing account?

Yes. An attacker needs to be authenticated as a low-privilege user; no user interaction is required.

What can an attacker do after exploiting the issue?

They can recategorize documents belonging to other patients, retrieve those documents with an empty patient_id, exfiltrate PHI, and tamper with patient charts.

GHSA-89j2-7cg2-mm93: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

Affected Software

Event History

Frequently Asked Questions

Which OpenEMR versions are affected?

Does exploitation require an existing account?

What can an attacker do after exploiting the issue?

Company

Resources

Contact

Frequently Asked Questions

Which OpenEMR versions are affected?

Does exploitation require an existing account?

What can an attacker do after exploiting the issue?