CVE-2026-104137

— UNSCOREDpublic exploit available

Published 2026-11-05 · Updated 2026-11-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

Weaknesses

CWE-284

Public exploit & PoC references

https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
https://github.com/openemr/openemr/pull/13200
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv

All references

https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
https://github.com/openemr/openemr/pull/13200
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/security/advisories/GHSA-h5hw-xfj8-vgrv

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2013-10077PoC
MEDIUMCVE-2023-54412PoC
CRITICALCVE-2024-34320
HIGHCVE-2025-70962PoC
HIGHCVE-2025-8574
HIGHCVE-2026-0053
HIGHCVE-2026-100114
HIGHCVE-2026-100115

Related by shared AI tags and CWE weakness class. Browse the full archive.