CVE-2026-104138

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the...

CVE-2026-104138 OpenEMR: Missing authorization on QRDA Category I/III download endpoints

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the...

CVE-2026-104138

Prior to version 8.3.0 , OpenEMR is vulnerable to a missing authorization flaw in the endpoints custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php. While these endpoints validate CSRF, they fail to enforce the patients/med ACL required by ...

CVE-2026-104138 OpenEMR: Missing authorization on QRDA Category I/III download endpoints

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the...