CVE-2026-103938

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The application fails to validate CSRF tokens for state-changing operations performed via GET requests at the 'interface/patient file/pos checkout ippf.php' endpoint. Specifically, the form checksum integrity check is conditional and skipped if the parameter is omitted. This allows a cross-site request to force an authenticated billing user to execute void, voidall, and regen operations, which can lead to the unauthorized voiding of checkouts or regeneration of invoice counters, potentially altering ledger states, financial reporting, and audit records.

Recommendations Update to version 8.3.0.