CVE-2026-104139

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and...

CVE-2026-104139 OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and...

CVE-2026-104139

The OpenEMR electronic health records application is vulnerable to a missing authorization flaw prior to version 8.3.0 . The library/ajax/set_pt.php endpoint allows authenticated users to set an arbitrary patient identifier in their active session without an ACL check. Consequently, a low-privile...