CVE-2026-102940

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description Write actions within controllers/C Document.class.php, specifically the move action process() function, fail to verify if the caller has appropriate access to the source document, the current patient and category, or the destination patient and category before the Document::change patient() function performs the mutation. This allows a low-privilege authenticated user to reassign an arbitrary document to a patient or category they can access, subsequently enabling them to retrieve the document through the standard protected read path. Because the reassignment happens before the final list rendering check, an HTTP 403 response does not indicate that the unauthorized write operation was blocked.

Recommendations Update to version 8.4.0.