{"id":"CVE-2026-63192","kind":"vulnerability","aliases":["CVE-2026-63192"],"related":[],"title":"OpenMRS bahmnicore module lets logged-in users leak database data","description":"OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.","summary":"The bahmnicore module for OpenMRS, which provides core modules for Bahmni including its ERP and ELIS Atom Feed clients, let an authenticated attacker pull sensitive data out of the database in version 0.93. The issue is fixed in version 0.93.1.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bahmni","healthcare","openmrs","other","self-hosted"],"not_affected_if":["no-authenticated-users-exposed","not-version-0.93"],"how_to_check":"- Check the installed bahmnicore module version in the OpenMRS modules directory or admin module list, and look for `0.93`.","fix":"- bahmnicore: move to `0.93.1`","status":"open","published_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:17+00:00","updated_at":"2026-11-11T03:26:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T03:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- bahmnicore: move to `0.93.1`","reach":"network","title":"OpenMRS bahmnicore module lets logged-in users leak database data","impact":"high","summary":"The bahmnicore module for OpenMRS, which provides core modules for Bahmni including its ERP and ELIS Atom Feed clients, let an authenticated attacker pull sensitive data out of the database in version 0.93. The issue is fixed in version 0.93.1.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openmrs","bahmni","healthcare","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads sensitive database records","analyst_note":"Confirm the affected version range and fix details from the vendor advisory on github.com and the NVD entry; the sources do not list product ranges.","how_to_check":"- Check the installed bahmnicore module version in the OpenMRS modules directory or admin module list, and look for `0.93`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-version-0.93","no-authenticated-users-exposed"],"who_is_affected":"Teams running Bahmni or OpenMRS with the bahmnicore module at version 0.93 are exposed. An attacker needs a valid account on the OpenMRS instance, so the risk is highest where many staff or outside users can log in.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4584,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63192':14A,17A '0.93':57B,82C '0.93.1':64B,103C 'access':87C 'atom':41B,77C 'attack':47B,84C 'authent':46B,86C 'bahmni':18B,35B,73C 'bahmnicor':2A,26B,67C 'client':43B,79C 'contain':68C 'core':32B,69C 'could':88C 'cve':12A,15A 'data':11A,50B,92C 'databas':10A,54B,95C 'eli':40B,76C 'erp':38B,75C 'exfiltr':90C 'feed':42B,78C 'fix':61B 'healthcar':19B 'host':24B 'includ':36B,74C 'issu':59B,97C 'leak':9A 'let':4A,44B 'log':6A 'logged-in':5A 'modul':3A,27B,33B,66C,71C 'openmr':1A,20B,29B,65C,70C 'patch':100C 'potenti':89C 'provid':31B 'pull':48B 'self':23B 'self-host':22B 'sensit':49B,91C 'user':8A 'version':56B,63B,81C,102C","nicknames":[],"mitigations":[],"who_affected":"Teams running Bahmni or OpenMRS with the bahmnicore module at version 0.93 are exposed. An attacker needs a valid account on the OpenMRS instance, so the risk is highest where many staff or outside users can log in.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bahmni","healthcare","high","openmrs","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63192':14A,17A 'bahmnicor':2A 'cve':12A,15A 'data':11A 'databas':10A 'leak':9A 'let':4A 'log':6A 'logged-in':5A 'modul':3A 'openmr':1A 'user':8A","search_b":"'0.93':57B '0.93.1':64B 'atom':41B 'attack':47B 'authent':46B 'bahmni':18B,35B 'bahmnicor':26B 'client':43B 'core':32B 'data':50B 'databas':54B 'eli':40B 'erp':38B 'feed':42B 'fix':61B 'healthcar':19B 'host':24B 'includ':36B 'issu':59B 'let':44B 'modul':27B,33B 'openmr':20B,29B 'provid':31B 'pull':48B 'self':23B 'self-host':22B 'sensit':49B 'version':56B,63B","search_c":"'0.93':82C '0.93.1':103C 'access':87C 'atom':77C 'attack':84C 'authent':86C 'bahmni':73C 'bahmnicor':67C 'client':79C 'contain':68C 'core':69C 'could':88C 'data':92C 'databas':95C 'eli':76C 'erp':75C 'exfiltr':90C 'feed':78C 'includ':74C 'issu':97C 'modul':66C,71C 'openmr':65C,70C 'patch':100C 'potenti':89C 'sensit':91C 'version':81C,102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T09:04:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63192","severity":null,"published_at":"2026-11-11T03:16:52+00:00","modified_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122064,"url":"https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T09:04:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}