CVE-2026-104137

high

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

References

https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv

https://github.com/openemr/openemr/releases/tag/v8_3_0

https://github.com/openemr/openemr/pull/13200

https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117765

Details

Source: Mitre, NVD

Published: 2026-11-05

Updated: 2026-11-06

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00313