CVE-2026-104139

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists where authenticated users can set an arbitrary patient identifier in the active session via the 'library/ajax/set pt.php' endpoint because it lacks an Access Control List (ACL) check. Subsequently, the 'interface/patient file/download template.php' endpoint trusts this session value, enforcing only Cross-Site Request Forgery (CSRF) validation. This allows a low-privilege user to select another patient and download a rendered document template containing sensitive data, including demographics, encounter information, allergies, medications, and the problem list, even without the required patients/docs access.

Recommendations Update to version 8.3.0.