CVE-2026-104136

— UNSCOREDpublic exploit available

Published 2026-11-05 · Updated 2026-11-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information. This issue is fixed in version 8.3.0.

Weaknesses

CWE-284

Public exploit & PoC references

https://github.com/openemr/openemr/commit/12fb549fd16ceed488c9d20281dba46f098ff107
https://github.com/openemr/openemr/pull/13343
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/security/advisories/GHSA-x6w3-3g4m-5m5v

All references

https://github.com/openemr/openemr/commit/12fb549fd16ceed488c9d20281dba46f098ff107
https://github.com/openemr/openemr/pull/13343
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/security/advisories/GHSA-x6w3-3g4m-5m5v

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2013-10077PoC
MEDIUMCVE-2023-54412PoC
CRITICALCVE-2024-34320
HIGHCVE-2025-70962PoC
HIGHCVE-2025-8574
HIGHCVE-2026-0053
HIGHCVE-2026-100114
HIGHCVE-2026-100115

Related by shared AI tags and CWE weakness class. Browse the full archive.