{"id":"CVE-2026-103938","kind":"vulnerability","aliases":["CVE-2026-103938"],"related":[],"title":"OpenEMR: cross-site requests can void billing checkouts and alter invoices","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.","summary":"OpenEMR's patient checkout page accepts state-changing void and regenerate actions through GET requests without CSRF token validation, and the checksum check is skipped when omitted. A malicious site can make a logged-in billing user void checkouts or regenerate invoice counters, altering ledger and audit records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["billing","healthcare","openemr","package","self-hosted"],"not_affected_if":["version-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version settings or `version.php` and compare it with the fixed release\n- Confirm whether `interface/patient_file/pos_checkout_ippf.php` is reachable by billing users","fix":"- OpenEMR: `8.3.0`","status":"open","published_at":"2026-11-05T20:17:38+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","triaged_at":"2026-11-05T20:43:17+00:00","updated_at":"2026-11-05T20:43:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T20:43:17Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.3.0`","reach":"internet","title":"OpenEMR: cross-site requests can void billing checkouts and alter invoices","impact":"medium","summary":"OpenEMR's patient checkout page accepts state-changing void and regenerate actions through GET requests without CSRF token validation, and the checksum check is skipped when omitted. A malicious site can make a logged-in billing user void checkouts or regenerate invoice counters, altering ledger and audit records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","billing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"billing checkouts voided and invoice records altered via forged requests","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the application's version settings or `version.php` and compare it with the fixed release\n- Confirm whether `interface/patient_file/pos_checkout_ippf.php` is reachable by billing users","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.3.0-or-later"],"who_is_affected":"Any site running OpenEMR before 8.3.0 where billing staff use the checkout pages while logged in. The exposure is through a browser session, so deployments that restrict billing access or sit behind strict session controls are lower risk. unknown whether the sources list other affected configurations.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000703,"input_tokens":4346,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103938':15A,18A '-2026':14A,17A '8.3.0':93C,163C 'accept':31B 'action':38B 'allow':126C 'alter':11A,71B,149C 'applic':90C 'audit':74B,155C 'authent':135C 'bill':8A,19B,63B,136C 'chang':34B,98C,147C 'check':49B,115C 'checkout':9A,29B,66B,140C 'checksum':48B,113C 'condit':117C 'counter':70B,144C 'cross':3A,129C 'cross-sit':2A,128C 'csrf':43B,108C 'cve':13A,16A 'electron':83C 'financi':152C 'fix':160C 'forc':133C 'form':112C 'free':79C 'get':40B,105C 'health':84C 'healthcar':20B 'host':25B 'integr':114C 'interface/patient_file/pos_checkout_ippf.php':94C 'invoic':12A,69B,143C 'issu':158C 'ledger':72B,150C 'log':61B 'logged-in':60B 'make':58B 'malici':55B 'manag':89C 'medic':87C 'omit':53B,125C 'open':81C 'openemr':1A,21B,26B,76C 'oper':103C 'packag':22B 'page':30B 'paramet':123C 'patient':28B 'perform':95C 'practic':88C 'prior':91C 'record':75B,85C,156C 'regen':102C 'regener':37B,68B,142C 'report':153C 'request':5A,41B,106C,131C 'result':146C 'self':24B 'self-host':23B 'site':4A,56B,130C 'skip':51B,120C 'sourc':82C 'state':33B,97C,151C 'state-chang':32B,96C 'token':44B,109C 'user':64B,137C 'valid':45B,110C 'version':162C 'void':7A,35B,65B,99C,139C 'voidal':100C 'without':42B,107C","nicknames":[],"mitigations":[],"who_affected":"Any site running OpenEMR before 8.3.0 where billing staff use the checkout pages while logged in. The exposure is through a browser session, so deployments that restrict billing access or sit behind strict session controls are lower risk. unknown whether the sources list other affected configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["billing","healthcare","high","openemr","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T08:47:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103938","severity":null,"published_at":"2026-11-05T20:17:38+00:00","modified_at":"2026-11-05T20:17:38+00:00","first_seen_at":"2026-11-05T20:40:43+00:00","fetched_at":"2026-11-05T20:40:43+00:00","note":null}],"documents":[{"id":79807,"url":"https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79809,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-p8j4-vmx9-rfhj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:47:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}