CVE-2026-104133 in OpenEMR
Summary
by MITRE • 11/05/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step. The action can corrupt lab-ordering configuration and require an administrator to restore the compendium. This issue is fixed in version 8.3.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
OpenEMR serves as a widely utilized open-source electronic health records system, providing critical infrastructure for medical practice management and patient data handling. Within this ecosystem, the DORN module facilitates laboratory ordering functionalities that are essential for clinical workflows. A significant security flaw was identified in versions prior to 8.3.0 within the file interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php. This component is responsible for managing the installation and configuration of lab compendiums, which define available test types and ordering rules. The vulnerability stems from an inconsistency in access control enforcement mechanisms across different administrative scripts associated with the DORN module.
The core technical flaw involves a failure to enforce consistent Access Control List checks during specific operations. While the compeadium_install.php script correctly implements authentication and Cross-Site Request Forgery protections, it fails to validate that the executing user possesses the necessary admin/users ACL permissions required by sibling administration scripts. This discrepancy creates an authorization bypass scenario where low-privilege authenticated users can perform actions intended exclusively for system administrators. Specifically, a malicious actor with basic authenticated access can supply a crafted labGuid parameter to trigger the LabCompendiumInstall::uninstall() function without meeting the elevated privilege requirements mandated elsewhere in the application logic.
The operational impact of this vulnerability is severe due to its potential to disrupt critical clinical operations. When exploited, the unauthorized uninstallation process deletes detail and result procedure types while simultaneously deactivating order types within the laboratory configuration database. This action effectively corrupts the lab-ordering infrastructure, rendering it impossible for healthcare providers to properly configure or execute standard diagnostic tests through the system. The damage is not merely cosmetic but structural, requiring manual intervention by a high-privilege administrator to restore the compendium and re-establish normal laboratory ordering capabilities. Such disruption can lead to significant delays in patient care and increased administrative overhead during recovery efforts.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to properly enforce access control policies for a critical function. Furthermore, it relates to CWE-732, involving incorrect permission assignment, because the script does not verify that the user holds the specific administrative role required for modifying system-wide configuration data. From an offensive perspective, this flaw allows for privilege escalation in terms of functional impact, enabling lower-tier users to perform high-level destructive actions, which can be categorized under ATT&CK techniques related to Defense Evasion or Impact via resource manipulation.
The issue was addressed and fixed in version 8.3.0 by ensuring that the compeadium_install.php script enforces the same strict ACL checks as other DORN administration scripts. To mitigate risks associated with this vulnerability, organizations running OpenEMR versions prior to 8.3.0 must upgrade immediately upon availability of the patched release. In environments where immediate patching is not feasible, administrators should restrict network access to the affected PHP endpoints and ensure that only trusted IP addresses can interact with laboratory configuration modules until the update is applied. Regular audits of user permissions and review of ACL configurations across all administrative interfaces are recommended to prevent similar inconsistencies in future deployments.