---
id: "CVE-2026-103020"
kind: "vulnerability"
aliases: ["CVE-2026-103020"]
title: "OpenEMR: unauthenticated multisite admin page leaks site and database details"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "php", "self-hosted"]
not_affected_if: ["version-8.3.0-or-later"]
published_at: "2026-11-05T20:17:37+00:00"
first_seen_at: "2026-11-05T20:40:43+00:00"
updated_at: "2026-11-05T20:43:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103020", "first_seen_at": "2026-11-05T20:40:43+00:00"}]
exploit_sources: []
---

# OpenEMR: unauthenticated multisite admin page leaks site and database details

OpenEMR, an electronic health records application, exposes its multisite admin page without an authentication check before version 8.3.0. An unauthenticated network attacker can learn site identifiers, database names, OpenEMR versions, upgrade status, and direct login and patient-portal links.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the deployed installation against `8.3.0`
- Check whether the webroot `admin.php` multisite page responds without logging in

## Fix

- OpenEMR: upgrade to `8.3.0`

## Timeline

- 2026-11-05T20:40:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103020

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-q366-cv5v-83w8
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/50f789fad45ada625fe8d0faf0c7a9c15ef52aa5
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_3_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_