CVE-2026-104137

UNKNOWN 0.0

OpenEMR: Patient Data Search Without Sufficient ACL

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

CWE	CWE-284
Vendor	openemr
Product	openemr
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for openemr openemr

Be the first to know when new unknown vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

openemr / openemr

< 8.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv github.com: https://github.com/openemr/openemr/pull/13200 github.com: https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36 github.com: https://github.com/openemr/openemr/releases/tag/v8_3_0