CVE-2026-102940

Summary

OpenEMR's document controller lacks authorization checks before allowing low-privilege users to reassign documents to patients or categories they shouldn't access, enabling data exfiltration via unauthorized document movement followed by legitimate read access.

Exploitability

Exploitation requires only a low-privilege authenticated user account and knowledge of valid document IDs; no special tools or conditions beyond standard web access are needed.

Blast radius

An attacker could reassign sensitive medical documents to accessible patients/categories, then read them through normal endpoints, leading to unauthorized disclosure of protected health information across patient boundaries.

Detection

Monitor for unexpected changes in document ownership (e.g., via audit logs tracking Document::change_patient calls) where the actor lacks permissions on both source and destination patients/categories; no reliable network or host-based indicator is derivable beyond such log anomalies.

Prioritized remediation

Upgrade to OpenEMR version 8.4.0 or later, which includes the fix that adds proper authorization verification before document reassignment.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.