---
id: "CVE-2026-103938"
kind: "vulnerability"
aliases: ["CVE-2026-103938"]
title: "OpenEMR: cross-site requests can void billing checkouts and alter invoices"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["billing", "healthcare", "openemr", "package", "self-hosted"]
not_affected_if: ["version-8.3.0-or-later"]
published_at: "2026-11-05T20:17:38+00:00"
first_seen_at: "2026-11-05T20:40:43+00:00"
updated_at: "2026-11-05T20:43:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103938", "first_seen_at": "2026-11-05T20:40:43+00:00"}]
exploit_sources: []
---

# OpenEMR: cross-site requests can void billing checkouts and alter invoices

OpenEMR's patient checkout page accepts state-changing void and regenerate actions through GET requests without CSRF token validation, and the checksum check is skipped when omitted. A malicious site can make a logged-in billing user void checkouts or regenerate invoice counters, altering ledger and audit records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenEMR version in the application's version settings or `version.php` and compare it with the fixed release
- Confirm whether `interface/patient_file/pos_checkout_ippf.php` is reachable by billing users

## Fix

- OpenEMR: `8.3.0`

## Timeline

- 2026-11-05T20:40:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103938

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-p8j4-vmx9-rfhj
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21b
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_3_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_