CVE-2026-103938

HighCVSS 7.1/10Last modified Nov 10, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1039395.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/c CVE-2026-1039468.3An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.CVE-2026-10395610.0Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain s CVE-2026-1039576.2Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain CVE-2026-1039587.6Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticate CVE-2026-1039626.1The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f CVE-2026-1039637.5A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session CVE-2026-1039644.3The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via t CVE-2026-1039655.4An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriti CVE-2026-1039667.8Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of t CVE-2026-1039677.8Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur CVE-2026-1039745.4lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who c