CVE-2026-103020

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The multisite administration page located at the 'admin.php' endpoint is enabled without an authentication check. This allows an unauthenticated network actor to read database configurations from sqlconf.php and connect to configured site databases. Consequently, an attacker can obtain site identifiers, database names, site names, exact software versions and patch levels, pending upgrade status, and direct links to logins and patient portals.

Recommendations Update to version 8.3.0.