MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-104135
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-06T06:16:30.423848+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 6.5
- Retrieved at
- 2026-11-06T06:17:09+00:00
- Score
- 6.5
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-104135
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-05T22:06:44+00:00
- Name
- CVE-2026-104135
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-11-05T20:17:38.980
- Last modified
- 2026-11-05T21:18:34.890
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph