CVE-2026-104136

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
openemr	openemr	< 8.3.0

References

https://github.com/openemr/openemr/commit/12fb549fd16ceed488c9d20281dba46f098ff107Patch
https://github.com/openemr/openemr/pull/13343Issue Tracking, Patch
https://github.com/openemr/openemr/releases/tag/v8_3_0Product, Release Notes
https://github.com/openemr/openemr/security/advisories/GHSA-x6w3-3g4m-5m5vExploit, Vendor Advisory
https://github.com/openemr/openemr/security/advisories/GHSA-x6w3-3g4m-5m5vExploit, Vendor Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1041376.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search bran CVE-2026-1041386.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_downloa CVE-2026-1041396.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt CVE-2026-1041406.1QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders fea CVE-2026-1041418.7DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names,CVE-2026-1041428.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, CVE-2026-1041438.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat CVE-2026-1041508.7AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression ret CVE-2026-1041815.4Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-fa CVE-2026-1041826.2stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC CVE-2026-1041835.1stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler CVE-2026-1041897.5The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions