PT-2026-139990

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r ID to remove...

CVE-2026-104136

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-104137

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-104136 OpenEMR: Arbitrary Patient Recall and Contact Detail Read

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-104136

The OpenEMR electronic health records application is vulnerable to an improper access control issue (CWE-284) in versions prior to 8.3.0 . Specifically, the new_recall branch of interface/main/messages/save.php fails to enforce patient-level or recall-workflow authorization when processing a call...

CVE-2026-104137

Prior to version 8.3.0 , OpenEMR is vulnerable to an Improper Access Control (CWE-284) issue within the sms_search branch of interface/main/messages/save.php. While the component requires an authenticated session, it fails to enforce patient or feature-level ACLs. This allows a low-privilege user...

CVE-2026-104137 OpenEMR: Patient Data Search Without Sufficient ACL

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...