CVE-2026-104138

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An issue exists where specific endpoints validate CSRF but fail to enforce the patients/med ACL (Access Control List), which is used by the canonical CQM report page. These endpoints accept an unscoped report id variable, enabling a low-privilege authenticated user to access report generation and download logic for reports they are not authorized to view. This can lead to the exposure of QRDA Category One and Category Three clinical documents for patients within a measure. The affected endpoints are 'custom/ajax download.php', 'custom/download qrda.php', 'custom/export qrda xml.php', and 'custom/qrda download.php'.

Recommendations Update to version 8.3.0.