CVE-2026-104133

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists in the DORN module where the endpoint 'interface/modules/custom modules/oe-module-dorn/public/compendium install.php' fails to enforce the admin/users Access Control List (ACL), despite verifying authentication and Cross-Site Request Forgery (CSRF) protections. A low-privilege authenticated user can provide a specific labGuid value, triggering the LabCompendiumInstall::uninstall() function. This process deletes detail and result procedure types and deactivates order types, which can corrupt the lab-ordering configuration and necessitate a manual restoration of the compendium by an administrator.

Recommendations Update to version 8.3.0. As a temporary mitigation, restrict access to the 'interface/modules/custom modules/oe-module-dorn/public/compendium install.php' endpoint or disable the DORN module.