CVE-2026-103939

MediumCVSS 5.4/10Last modified Nov 10, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-weno/scripts/file_download.php has no ACL or CSRF check and ignores the result of validateAdminCredentials(). When the Weno module is enabled, the default GET path calls PharmacyService::removeWenoPharmacies() before attempting a refetch, allowing any authenticated user to truncate the weno_pharmacy table and allowing a cross-site request to trigger the same operation through a logged-in victim. A failed later download can leave the e-prescribing pharmacy directory empty and unavailable. This issue is fixed in version 8.3.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
openemr	openemr	< 8.3.0

References

https://github.com/openemr/openemr/commit/f760adc7bddaf9d118e1a0d40590e686783ed21bPatch
https://github.com/openemr/openemr/pull/13197Issue Tracking, Patch
https://github.com/openemr/openemr/releases/tag/v8_3_0Product, Release Notes
https://github.com/openemr/openemr/security/advisories/GHSA-xhv3-qr55-56h3Exploit, Mitigation, Vendor Advisory
https://github.com/openemr/openemr/security/advisories/GHSA-xhv3-qr55-56h3Exploit, Mitigation, Vendor Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1039468.3An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.CVE-2026-10395610.0Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain s CVE-2026-1039576.2Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain CVE-2026-1039587.6Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticate CVE-2026-1039626.1The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f CVE-2026-1039637.5A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session CVE-2026-1039644.3The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via t CVE-2026-1039655.4An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriti CVE-2026-1039667.8Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of t CVE-2026-1039677.8Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cur CVE-2026-1039745.4lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who c CVE-2026-1039756.5Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/s