CVE-2026-104134

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description The search persons action in the endpoint 'library/ajax/person search ajax.php' fails to perform an AclMain authorization check, although it validates CSRF (Cross-Site Request Forgery, a type of attack that forces an authenticated user to execute unwanted actions). This allows a low-privilege authenticated user to iterate name prefixes and retrieve sensitive patient information, including first and last names, dates of birth, gender, phone numbers, and email addresses, via JSON responses.

Recommendations Update to version 8.3.0.