{"id":"CVE-2026-103020","kind":"vulnerability","aliases":["CVE-2026-103020"],"related":[],"title":"OpenEMR: unauthenticated multisite admin page leaks site and database details","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.","summary":"OpenEMR, an electronic health records application, exposes its multisite admin page without an authentication check before version 8.3.0. An unauthenticated network attacker can learn site identifiers, database names, OpenEMR versions, upgrade status, and direct login and patient-portal links.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["version-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the deployed installation against `8.3.0`\n- Check whether the webroot `admin.php` multisite page responds without logging in","fix":"- OpenEMR: upgrade to `8.3.0`","status":"open","published_at":"2026-11-05T20:17:37+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","triaged_at":"2026-11-05T20:43:31+00:00","updated_at":"2026-11-05T20:43:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T20:43:31Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.3.0`","reach":"network","title":"OpenEMR: unauthenticated multisite admin page leaks site and database details","impact":"low","summary":"OpenEMR, an electronic health records application, exposes its multisite admin page without an authentication check before version 8.3.0. An unauthenticated network attacker can learn site identifiers, database names, OpenEMR versions, upgrade status, and direct login and patient-portal links.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads database names, site details and login links","analyst_note":"","how_to_check":"- Check the OpenEMR version in the deployed installation against `8.3.0`\n- Check whether the webroot `admin.php` multisite page responds without logging in","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.3.0-or-later"],"who_is_affected":"Any OpenEMR installation before 8.3.0 that serves the webroot admin.php multisite administration page is exposed to unauthenticated network requests. Installations on a patched release, or where the admin page is not reachable from the network, are not affected. Sources do not describe further configuration conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4318,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103020':13A,16A '-2026':12A,15A '8.3.0':41B,81C,141C 'actor':109C 'admin':4A,33B 'admin.php':84C 'administr':86C 'applic':29B,78C 'attack':45B 'authent':37B,92C 'check':38B,93C 'configur':96C,103C 'connect':100C 'cve':11A,14A 'databas':9A,50B,95C,105C,114C 'detail':10A 'direct':57B,128C 'electron':26B,71C 'enabl':89C 'exact':118C 'expos':30B 'fix':138C 'free':67C 'health':27B,72C 'healthcar':17B 'host':23B 'identifi':49B,113C 'issu':136C 'leak':6A 'learn':47B 'level':123C 'link':63B,134C 'login':58B,129C 'manag':77C 'medic':75C 'multisit':3A,32B,85C 'name':51B,115C,117C 'network':44B,108C 'obtain':111C 'open':69C 'openemr':1A,18B,24B,52B,64C,119C 'packag':19B 'page':5A,34B,87C 'patch':122C 'patient':61B,132C 'patient-port':60B,131C 'pend':124C 'php':20B 'portal':62B,133C 'practic':76C 'prior':79C 'read':94C 'record':28B,73C 'self':22B 'self-host':21B 'site':7A,48B,104C,112C,116C 'sourc':70C 'sqlconf.php':98C 'status':55B,126C 'unauthent':2A,43B,107C 'upgrad':54B,125C 'version':40B,53B,120C,140C 'webroot':83C 'without':35B,90C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR installation before 8.3.0 that serves the webroot admin.php multisite administration page is exposed to unauthenticated network requests. Installations on a patched release, or where the admin page is not reachable from the network, are not affected. Sources do not describe further configuration conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T09:06:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103020","severity":null,"published_at":"2026-11-05T20:17:37+00:00","modified_at":"2026-11-05T20:17:37+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","fetched_at":"2026-11-05T20:40:43+00:00","note":null}],"documents":[{"id":79795,"url":"https://github.com/openemr/openemr/commit/50f789fad45ada625fe8d0faf0c7a9c15ef52aa5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79800,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q366-cv5v-83w8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T09:06:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}