CVE-2026-104134

Full vulnerability record from the local CVENow database.

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.

Severity

MEDIUM

CVSS score

6.5 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 20:17:38.827000

Last modified

2026-11-05 20:17:38.827000

View original CVE JSON

{
  "id": "CVE-2026-104134",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T20:17:38.827",
  "lastModified": "2026-11-05T20:17:38.827",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "openemr",
          "product": "openemr",
          "versions": [
            {
              "version": "< 8.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openemr/openemr/pull/13200",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openemr/openemr/releases/tag/v8_3_0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openemr/openemr/security/advisories/GHSA-xhfm-5pwg-3cxv",
      "source": "[email protected]"
    }
  ]
}