{"id":"CVE-2026-102940","kind":"vulnerability","aliases":["CVE-2026-102940"],"related":[],"title":"OpenEMR: low-privilege users can reassign any patient's document","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.","summary":"OpenEMR, an electronic health records application, fails to check document access on move actions before reassigning documents. A low-privilege logged-in user can move any document to a patient or category they can reach and then read it, exposing protected medical records.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-low-privilege-users","openemr-8.4.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application footer or `version.php` and compare it with the fixed version.\n- Confirm whether untrusted or low-privilege user accounts exist on the instance.","fix":"- OpenEMR: upgrade to `8.4.0` or later.","status":"open","published_at":"2026-11-05T20:17:37+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","triaged_at":"2026-11-05T20:42:50+00:00","updated_at":"2026-11-05T20:42:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:42:50Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.4.0` or later.","reach":"network","title":"OpenEMR: low-privilege users can reassign any patient's document","impact":"high","summary":"OpenEMR, an electronic health records application, fails to check document access on move actions before reassigning documents. A low-privilege logged-in user can move any document to a patient or category they can reach and then read it, exposing protected medical records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege user reads any patient's protected documents","analyst_note":"Confirm affected version range beyond 'prior to 8.4.0' and check the vendor advisory and release notes linked from the NVD entry.","how_to_check":"- Check the installed OpenEMR version in the application footer or `version.php` and compare it with the fixed version.\n- Confirm whether untrusted or low-privilege user accounts exist on the instance.","plain_action":"","needs_analyst":true,"not_affected_if":["openemr-8.4.0-or-later","no-low-privilege-users"],"who_is_affected":"Any OpenEMR deployment before 8.4.0 with authenticated users below administrator level is exposed, since the flaw is in the document move write path that such users can reach. Installations where only fully trusted staff can log in are at lower practical risk but should still upgrade. Hosts that are not running OpenEMR can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000721,"input_tokens":4365,"output_tokens":569,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102940':14A,17A '-2026':13A,16A '403':165C '8.4.0':87C,181C 'access':35B,101C,141C 'action':38B,90C,93C 'applic':30B,84C 'arbitrari':131C 'authent':126C 'block':174C 'caller':99C 'categori':58B,109C,114C,137C 'chang':117C 'check':33B,160C 'controllers/c_document.class.php':88C 'current':106C 'cve':12A,15A 'destin':111C 'document':11A,34B,41B,53B,105C,116C,132C 'electron':27B,77C 'expos':66B 'fail':31B 'final':163C 'fix':178C 'free':73C 'health':28B,78C 'healthcar':18B 'host':24B 'http':164C 'includ':91C 'issu':176C 'later':157C 'list':158C 'log':47B 'logged-in':46B 'low':3A,44B,124C 'low-privileg':2A,43B,123C 'manag':83C 'mean':169C 'medic':68B,81C 'move':37B,51B,92C 'mutat':121C 'normal':148C 'occur':154C 'open':75C 'openemr':1A,19B,25B,70C 'path':151C 'patient':9A,56B,107C,112C,118C,135C 'perform':119C 'php':20B 'practic':82C 'prior':85C 'privileg':4A,45B,125C 'process':94C 'protect':67B,149C 'reach':61B 'read':64B,150C 'reassign':7A,40B,129C,153C 'record':29B,69B,79C 'render':159C 'respons':166C 'retriev':144C 'runtim':21B 'self':23B 'self-host':22B 'sourc':76C,104C 'unauthor':171C 'user':5A,49B,127C,139C 'verifi':97C 'version':180C 'write':89C,172C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.4.0 with authenticated users below administrator level is exposed, since the flaw is in the document move write path that such users can reach. Installations where only fully trusted staff can log in are at lower practical risk but should still upgrade. Hosts that are not running OpenEMR can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","healthcare","openemr","php","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-09-13T09:44:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102940","severity":null,"published_at":"2026-11-05T20:17:37+00:00","modified_at":"2026-11-05T20:17:37+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","fetched_at":"2026-11-05T20:40:43+00:00","note":null}],"documents":[{"id":79792,"url":"https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79794,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-92rh-g949-4mvv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-13T09:44:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}