CVE-2026-104137

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the sms search branch of the 'interface/main/messages/save.php' endpoint. While an authenticated session is required, the system fails to enforce patient or feature-level Access Control Lists (ACLs), which are security rules that define which users have access to specific resources. Consequently, a low-privilege user can search the MedEx SMS endpoint to retrieve sensitive data, including patient identifiers, names, phone numbers, SMS permission status, and recent message information.

Recommendations Update to version 8.3.0.