CVE-2026-104138

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
openemr	openemr	< 8.3.0

References

https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36Patch
https://github.com/openemr/openemr/pull/13200Issue Tracking, Patch
https://github.com/openemr/openemr/releases/tag/v8_3_0Product, Release Notes
https://github.com/openemr/openemr/security/advisories/GHSA-6p9h-59cp-8hxjExploit, Mitigation, Vendor Advisory
https://github.com/openemr/openemr/security/advisories/GHSA-6p9h-59cp-8hxjExploit, Mitigation, Vendor Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1041396.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt CVE-2026-1041406.1QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders fea CVE-2026-1041418.7DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names,CVE-2026-1041428.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, CVE-2026-1041438.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat CVE-2026-1041508.7AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression ret CVE-2026-1041815.4Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-fa CVE-2026-1041826.2stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC CVE-2026-1041835.1stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler CVE-2026-1041897.5The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions CVE-2026-1041929.6Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_CVE-2026-1041985.3ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mish