{"id":"CVE-2026-104139","kind":"vulnerability","aliases":["CVE-2026-104139"],"related":[],"title":"OpenEMR: low-privilege users can download other patients' records","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patient_file/download_template.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0.","summary":"OpenEMR, an electronic health records application, lets any logged-in user switch the active patient in their session without an access check. A low-privilege user can then download a rendered template containing another patient's demographics, allergies, medications and problem list.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-untrusted-logins","openemr-8.3.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; versions below `8.3.0` are listed as affected\n- Review the OpenEMR release notes and the vendor advisory linked from the NVD entry for configuration guidance","fix":"- OpenEMR: `8.3.0`","status":"open","published_at":"2026-11-05T20:17:39+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:43:18+00:00","updated_at":"2026-11-05T20:43:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T20:43:18Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.3.0`","reach":"network","title":"OpenEMR: low-privilege users can download other patients' records","impact":"medium","summary":"OpenEMR, an electronic health records application, lets any logged-in user switch the active patient in their session without an access check. A low-privilege user can then download a rendered template containing another patient's demographics, allergies, medications and problem list.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Patient health records readable by low-privilege accounts without access rights","analyst_note":"Confirm the affected version range and whether the vendor advisory names any configuration; sources here give only 'prior to 8.3.0'.","how_to_check":"- Check the OpenEMR version in the installation; versions below `8.3.0` are listed as affected\n- Review the OpenEMR release notes and the vendor advisory linked from the NVD entry for configuration guidance\n- unknown whether the sources list a specific configuration that exposes the flaw","plain_action":"","needs_analyst":true,"not_affected_if":["openemr-8.3.0-or-later","no-untrusted-logins"],"who_is_affected":"Any OpenEMR installation before 8.3.0 with user accounts that lack patient document access is exposed, since any authenticated user can reach the flawed endpoints. Installations where only fully trusted staff have logins carry less practical risk, but the flaw still crosses patient-access boundaries. Systems that do not run OpenEMR can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4341,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104139':13A,16A '-2026':12A,15A '8.3.0':85C,153C 'access':45B,146C 'acl':103C 'activ':38B,99C 'allergi':63B,138C 'allow':87C 'anoth':59B,123C 'applic':29B,82C 'arbitrari':94C 'authent':89C 'check':46B,104C 'contain':58B,131C 'csrf':114C 'cve':11A,14A 'demograph':62B,135C 'despit':143C 'document':129C 'download':7A,54B,126C 'electron':26B,75C 'encount':136C 'enforc':112C 'fix':150C 'free':71C 'health':27B,76C 'healthcar':17B 'host':23B 'identifi':96C 'inform':137C 'interface/patient_file/download_template.php':106C 'issu':148C 'lack':144C 'let':30B 'library/ajax/set_pt.php':86C 'list':67B,142C 'log':33B 'logged-in':32B 'low':3A,49B,118C 'low-privileg':2A,48B,117C 'manag':81C 'medic':64B,79C,139C 'open':73C 'openemr':1A,18B,24B,68C 'patient':9A,39B,60B,95C,124C,133C 'patients/docs':145C 'php':19B 'practic':80C 'prior':83C 'privileg':4A,50B,119C 'problem':66B,141C 'record':10A,28B,77C 'render':56B,128C 'runtim':20B 'select':122C 'self':22B 'self-host':21B 'session':42B,100C,109C 'set':92C 'sourc':74C 'switch':36B 'templat':57B,130C 'trust':107C 'user':5A,35B,51B,90C,120C 'valid':115C 'valu':110C 'version':152C 'without':43B,101C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR installation before 8.3.0 with user accounts that lack patient document access is exposed, since any authenticated user can reach the flawed endpoints. Installations where only fully trusted staff have logins carry less practical risk, but the flaw still crosses patient-access boundaries. Systems that do not run OpenEMR can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","php","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-18T08:55:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104139","severity":null,"published_at":"2026-11-05T20:17:39+00:00","modified_at":"2026-11-05T20:17:39+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null}],"documents":[{"id":79813,"url":"https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79793,"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79833,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-r3q3-p493-95x8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:55:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}