{"id":"CVE-2026-104137","kind":"vulnerability","aliases":["CVE-2026-104137"],"related":[],"title":"OpenEMR: low-privilege users can read patient names and phone numbers","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.","summary":"OpenEMR, an electronic health records application, has an SMS search endpoint in interface/main/messages/save.php that checks for a logged-in session but not patient or feature access rights. A low-privilege authenticated user can receive patient identifiers, names, phone numbers, SMS permission status and recent message details.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-low-privilege-users","version-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.3.0` are affected.\n- Confirm whether the MedEx SMS feature is in use, since the flaw is in its search branch.","fix":"- OpenEMR: move to `8.3.0` or later.","status":"open","published_at":"2026-11-05T20:17:39+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:43:13+00:00","updated_at":"2026-11-05T20:43:13+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T20:43:13Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.3.0` or later.","reach":"network","title":"OpenEMR: low-privilege users can read patient names and phone numbers","impact":"high","summary":"OpenEMR, an electronic health records application, has an SMS search endpoint in interface/main/messages/save.php that checks for a logged-in session but not patient or feature access rights. A low-privilege authenticated user can receive patient identifiers, names, phone numbers, SMS permission status and recent message details.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege staff read patient names, phone numbers and SMS status","analyst_note":"Confirm whether the MedEx SMS feature is enabled by default and whether the NVD entry or the vendor advisory lists any workaround before 8.3.0.","how_to_check":"- Check the OpenEMR version in the installed application; versions before `8.3.0` are affected.\n- Confirm whether the MedEx SMS feature is in use, since the flaw is in its search branch.\n- unknown whether the sources give a configuration check beyond the version.","plain_action":"","needs_analyst":true,"not_affected_if":["version-8.3.0-or-later","no-low-privilege-users"],"who_is_affected":"Clinics and practices that run OpenEMR themselves before version 8.3.0 and have staff accounts with limited privileges are exposed, since any logged-in user can reach the SMS search endpoint. Sites using a hosted vendor copy, or with only fully privileged users, face less risk; the sources do not say which deployments are excluded.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4316,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104137':15A,18A '-2026':14A,17A '8.3.0':91C,152C 'access':52B,119C 'acl':111C 'applic':31B,88C 'authent':58B,100C 'branch':95C 'cannot':118C 'check':40B 'cve':13A,16A 'data':121C 'detail':73B 'electron':28B,81C 'endpoint':36B,131C 'enforc':105C 'featur':51B,109C 'feature-level':108C 'fix':149C 'free':77C 'health':29B,82C 'healthcar':19B 'host':25B 'identifi':63B,135C 'inform':145C 'interfac':125C 'interface/main/messages/save.php':38B,97C 'issu':147C 'level':110C 'log':44B 'logged-in':43B 'low':3A,56B,114C 'low-privileg':2A,55B,113C 'manag':87C 'medex':129C 'medic':85C 'messag':72B,144C 'name':9A,64B,136C 'normal':124C 'number':12A,66B,138C 'open':79C 'openemr':1A,20B,26B,74C 'patient':8A,49B,62B,106C,120C,134C 'permiss':68B,140C 'phone':11A,65B,137C 'php':21B 'practic':86C 'prior':89C 'privileg':4A,57B,115C 'read':7A 'receiv':61B,133C 'recent':71B,143C 'record':30B,83C 'requir':98C 'right':53B 'runtim':22B 'search':35B,94C,127C 'self':24B 'self-host':23B 'session':46B,101C 'sms':34B,67B,93C,130C,139C 'sourc':80C 'status':69B,141C 'user':5A,59B,116C 'version':151C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices that run OpenEMR themselves before version 8.3.0 and have staff accounts with limited privileges are exposed, since any logged-in user can reach the SMS search endpoint. Sites using a hosted vendor copy, or with only fully privileged users, face less risk; the sources do not say which deployments are excluded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","php","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T08:53:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104137","severity":null,"published_at":"2026-11-05T20:17:39+00:00","modified_at":"2026-11-05T20:17:39+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null}],"documents":[{"id":79813,"url":"https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79827,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:53:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}