CVE-2026-104135

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the 'library/ajax/payment ajax.php' endpoint where the system validates a CSRF token but fails to perform an AclMain authorization check before executing a wildcard search of patient data. This allows any authenticated user, including those with non-clinical roles, to enumerate patient identifiers, full names, and dates of birth through the set patient branch.

Recommendations Update to version 8.3.0.