CVE-2026-104136

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the new recall branch of the 'interface/main/messages/save.php' endpoint where the system accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. This allows a low-privilege authenticated user who knows or enumerates a patient identifier to retrieve sensitive data, including patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information.

Recommendations Update to version 8.3.0.