CVE-2026-104136

UNKNOWN 0.0

OpenEMR: Arbitrary Patient Recall and Contact Detail Read

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.

CWE	CWE-284
Vendor	openemr
Product	openemr
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for openemr openemr

Be the first to know when new unknown vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

openemr / openemr

< 8.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openemr/openemr/security/advisories/GHSA-x6w3-3g4m-5m5v github.com: https://github.com/openemr/openemr/pull/13343 github.com: https://github.com/openemr/openemr/commit/12fb549fd16ceed488c9d20281dba46f098ff107 github.com: https://github.com/openemr/openemr/releases/tag/v8_3_0