CVE-2026-103939

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The application lacks Access Control List (ACL) and Cross-Site Request Forgery (CSRF) checks in the 'interface/modules/custom modules/oe-module-weno/scripts/file download.php' endpoint and ignores the result of the validateAdminCredentials() function. When the Weno module is active, the default GET path triggers the PharmacyService::removeWenoPharmacies() function before a refetch attempt. This allows any authenticated user or a cross-site request via a logged-in victim to truncate the weno pharmacy table, potentially leaving the e-prescribing pharmacy directory empty and unavailable if a subsequent download fails.

Recommendations Update to version 8.3.0. As a temporary mitigation, disable the Weno module to prevent unauthorized access to the affected functionality.