CVE-2026-104136 OpenEMR: Arbitrary Patient Recall and Contact Detail Read

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...