CVE-2026-104134

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the searchpersons action in library/ajax/personsearchajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patientdata...

CVE-2026-104134

In OpenEMR versions prior to 8.3.0 , a missing AclMain authorization check in the search_persons action (found in library/ajax/person_search_ajax.php) allows for unauthorized data access. While the application validates CSRF, it fails to verify permissions before querying the person and patient_d...