CVE-2026-104136

The OpenEMR electronic health records application is vulnerable to an improper access control issue (CWE-284) in versions prior to 8.3.0 . Specifically, the new_recall branch of interface/main/messages/save.php fails to enforce patient-level or recall-workflow authorization when processing a call...

CVE-2026-104137

Prior to version 8.3.0 , OpenEMR is vulnerable to an Improper Access Control (CWE-284) issue within the sms_search branch of interface/main/messages/save.php. While the component requires an authenticated session, it fails to enforce patient or feature-level ACLs. This allows a low-privilege user...