CVE-2026-103020 in OpenEMR
Summary
by MITRE • 11/05/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
OpenEMR serves as a widely deployed open-source electronic health records system designed to manage medical practice workflows and patient data. The vulnerability identified affects versions prior to 8.3.0, specifically targeting the administrative interface located at admin.php within the webroot directory. This endpoint is intended for multisite administration but suffers from a critical authentication bypass flaw that allows unauthenticated access over the network. By exploiting this misconfiguration, an attacker can interact with the administrative panel without providing valid credentials, effectively treating it as a public-facing resource rather than a secured internal tool.
The technical root cause of this vulnerability lies in the absence of proper session validation or access control checks on the admin.php page before it executes database queries to gather configuration details. The application reads its database connection parameters from sqlconf.php and proceeds to connect to each configured site database associated with the multisite installation. This process is triggered simply by accessing the URL, without verifying if the requester has been authenticated as an administrator. Consequently, the system exposes sensitive internal metadata that should remain hidden from external actors.
The operational impact of this vulnerability is significant due to the depth of information disclosure enabled for unauthenticated users. Attackers can retrieve site identifiers, database names, and specific site names associated with the OpenEMR installation. Furthermore, the application reveals exact version numbers and patch levels, which allows attackers to correlate the software state with known public exploits or vulnerabilities affecting that specific release. The exposure also includes information regarding pending upgrade statuses, providing insight into whether a system is vulnerable or has been partially remediated. Additionally, direct login links for patient portals are exposed, facilitating targeted phishing attacks or credential stuffing attempts against end-users who rely on these services.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In the context of the MITRE ATT&CK framework, this behavior corresponds to Discovery techniques such as T1592 Gather Victim Host Information or T1537 Transfer Data to Cloud Account if the data is exfiltrated externally, though primarily it serves reconnaissance purposes that precede more severe exploitation phases like T1078 Valid Accounts. The exposure of versioning and database structures significantly lowers the barrier for subsequent attacks by providing precise targeting information.
Mitigation strategies focus on immediate remediation through software updates and defensive configuration hardening. Organizations running OpenEMR must upgrade to version 8.3.0 or later, where this authentication bypass has been resolved. For environments unable to update immediately due to compatibility constraints, administrators should implement network-level access controls such as firewall rules that restrict access to the admin.php endpoint exclusively from trusted internal IP addresses. Additionally, web application firewalls can be configured to block requests attempting to access administrative paths without valid session tokens. Regular security audits and penetration testing are recommended to ensure no other endpoints suffer from similar authentication deficiencies within the multisite architecture.