---
id: "CVE-2026-63192"
page: "https://infrastack.ai/live/CVE-2026-63192"
kind: "vulnerability"
aliases: ["CVE-2026-63192"]
title: "OpenMRS bahmnicore module lets logged-in users leak database data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bahmni", "healthcare", "openmrs", "other", "self-hosted"]
not_affected_if: ["no-authenticated-users-exposed", "not-version-0.93"]
published_at: "2026-11-11T03:16:52+00:00"
first_seen_at: "2026-11-11T03:25:00+00:00"
updated_at: "2026-11-11T03:26:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63192", "first_seen_at": "2026-11-11T03:25:00+00:00"}]
exploit_sources: []
---

# OpenMRS bahmnicore module lets logged-in users leak database data

Link for people: https://infrastack.ai/live/CVE-2026-63192 (this .md is for agents)

The bahmnicore module for OpenMRS, which provides core modules for Bahmni including its ERP and ELIS Atom Feed clients, let an authenticated attacker pull sensitive data out of the database in version 0.93. The issue is fixed in version 0.93.1.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed bahmnicore module version in the OpenMRS modules directory or admin module list, and look for `0.93`.

## Fix

- bahmnicore: move to `0.93.1`

## Timeline

- 2026-11-11T03:25:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63192

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5

## From the sources

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_