CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

PT-2026-137722

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0 Description Write actions within controllers/C Document.class.php, specifically the move action process function, fail to verify if the caller has appropriate access to the source document, the current patient a...