CVE-2026-104137
OpenEMR is a free and open source electronic health records and medical practice management…
- Risk score
- 43/100
- CVSS
- 7.1 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data th…
- Affected
- See advisory
- Fix
- Upgrade the product to 8.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.
Last activity 5 Nov 2026. Patch Forecast updates every hour.