CVE-2026-104133 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records application, has an endpoint in the DORN lab module that skips the admin users permission check its sibling scripts enforce. An authenticated low-privilege user can trigger an uninstall that deletes lab detail and result procedure types and deactivates order types, breaking lab ordering until an administrator restores the compendium.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only OpenEMR installations running versions before 8.3.0 with the DORN lab module enabled are exposed. An attacker needs a logged-in account, though any low-privilege account is enough, since the missing check is the admin ACL. Installations without the DORN module, or on 8.3.0 and later, are not affected.
Not affected if dorn-module-disabled, openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0 or later is fixed; anything earlier is affected.interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php exists on the server.8.3.0 or later.OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step. The action can corrupt lab-ordering configuration and require an administrator to restore the compendium. This issue is fixed in version 8.3.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.