---
id: "CVE-2026-104137"
kind: "vulnerability"
aliases: ["CVE-2026-104137"]
title: "OpenEMR: low-privilege users can read patient names and phone numbers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "php", "runtime", "self-hosted"]
not_affected_if: ["no-low-privilege-users", "version-8.3.0-or-later"]
published_at: "2026-11-05T20:17:39+00:00"
first_seen_at: "2026-11-05T20:40:44+00:00"
updated_at: "2026-11-05T20:43:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104137", "first_seen_at": "2026-11-05T20:40:44+00:00"}]
exploit_sources: []
---

# OpenEMR: low-privilege users can read patient names and phone numbers

OpenEMR, an electronic health records application, has an SMS search endpoint in interface/main/messages/save.php that checks for a logged-in session but not patient or feature access rights. A low-privilege authenticated user can receive patient identifiers, names, phone numbers, SMS permission status and recent message details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in the installed application; versions before `8.3.0` are affected.
- Confirm whether the MedEx SMS feature is in use, since the flaw is in its search branch.

## Fix

- OpenEMR: move to `8.3.0` or later.

## Timeline

- 2026-11-05T20:40:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104137

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv
- [fix] Patch: github.com https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
- [fix] Release notes: github.com https://github.com/openemr/openemr/releases/tag/v8_3_0

## From the sources

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_