---
id: "CVE-2026-104133"
kind: "vulnerability"
aliases: ["CVE-2026-104133"]
title: "OpenEMR: low-privilege user can corrupt lab-ordering configuration via DORN module"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "package", "php", "self-hosted"]
not_affected_if: ["dorn-module-disabled", "openemr-8.3.0-or-later"]
published_at: "2026-11-05T20:17:38+00:00"
first_seen_at: "2026-11-05T20:40:43+00:00"
updated_at: "2026-11-05T20:43:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104133", "first_seen_at": "2026-11-05T20:40:43+00:00"}]
exploit_sources: []
---

# OpenEMR: low-privilege user can corrupt lab-ordering configuration via DORN module

OpenEMR, an electronic health records application, has an endpoint in the DORN lab module that skips the admin users permission check its sibling scripts enforce. An authenticated low-privilege user can trigger an uninstall that deletes lab detail and result procedure types and deactivates order types, breaking lab ordering until an administrator restores the compendium.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the DORN module is enabled in OpenEMR's module manager.
- Check the OpenEMR version: `8.3.0` or later is fixed; anything earlier is affected.
- Confirm the file `interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php` exists on the server.

## Fix

- OpenEMR: move to `8.3.0` or later.

## Timeline

- 2026-11-05T20:40:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104133

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-jh2v-595q-h9vc
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_3_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step. The action can corrupt lab-ordering configuration and require an administrator to restore the compendium. This issue is fixed in version 8.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_