CVE-2026-103938 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR's patient checkout page accepts state-changing void and regenerate actions through GET requests without CSRF token validation, and the checksum check is skipped when omitted. A malicious site can make a logged-in billing user void checkouts or regenerate invoice counters, altering ledger and audit records.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any site running OpenEMR before 8.3.0 where billing staff use the checkout pages while logged in. The exposure is through a browser session, so deployments that restrict billing access or sit behind strict session controls are lower risk. unknown whether the sources list other affected configurations.
Not affected if version-8.3.0-or-later
Who cares billing, healthcare, openemr, self-hosted
version.php and compare it with the fixed releaseinterface/patient_file/pos_checkout_ippf.php is reachable by billing users8.3.0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.