CVE-2026-104134 in OpenEMR
Summary
by MITRE • 11/05/2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
OpenEMR serves as a widely deployed open-source electronic health records system that manages sensitive medical data for healthcare practices. The vulnerability identified within versions prior to 8.3.0 resides specifically in the search_persons action located in the library/ajax/person_search_ajax.php file. This component is responsible for handling queries related to patient and person information via AJAX requests, a common pattern in modern web applications to provide dynamic user interfaces without full page reloads. The core technical flaw involves an incomplete authorization check mechanism during this specific operation. While the application correctly implements Cross-Site Request Forgery (CSRF) protection by validating CSRF tokens for incoming requests, it fails to perform an Access Control List (ACL) main authorization check before executing database queries against the person and patient_data tables. This discrepancy creates a critical gap in security logic where authentication is verified but proper role-based access control is not enforced for this specific endpoint.
The operational impact of this vulnerability allows any authenticated user with low privileges to enumerate sensitive personal health information that they should not have access to under normal circumstances. By iterating through various name prefixes, an attacker can systematically query the database and retrieve JSON responses containing detailed patient data. This includes first names, last names, dates of birth, gender, phone numbers, and email addresses. In a healthcare environment, such exposure violates fundamental privacy principles and regulatory requirements regarding protected health information. The ability to scrape this data in bulk due to the lack of authorization checks means that an attacker can potentially compile comprehensive profiles of patients without needing elevated privileges or exploiting complex injection flaws. This represents a significant breach of confidentiality within the application's security model.
From a classification perspective, this vulnerability aligns with CWE-285 Improper Authorization, as the system fails to enforce proper access controls for authenticated users on specific resources. It also relates to CWE-601 URL Redirection to Untrusted Site (Open Redirect) in broader contexts of data leakage but is primarily an authorization bypass issue. In terms of offensive security frameworks like MITRE ATT&CK, this behavior facilitates the Data from Information Repositories technique under the Collection tactic, where adversaries gather information stored within organizational systems. The lack of granular permission checks for AJAX endpoints highlights a common architectural weakness in web applications that prioritize CSRF protection while neglecting fine-grained access control on individual API actions or database queries triggered by those actions.
To mitigate this vulnerability and prevent similar issues in future development cycles, it is essential to implement strict role-based access control (RBAC) checks before executing any data retrieval operations against sensitive tables like person_data. Developers should ensure that every AJAX endpoint validates not only the authenticity of the request via CSRF tokens but also verifies that the authenticated user possesses the specific permissions required for the requested action. Additionally, implementing rate limiting on search endpoints can help mitigate enumeration attacks by restricting the number of queries a single session or IP address can perform within a given timeframe. Upgrading to version 8.3.0 resolves this issue as it includes the necessary authorization checks in the person_search_ajax.php file. For organizations unable to upgrade immediately, applying network-level access controls and monitoring for unusual patterns of patient data retrieval via API logs can provide temporary defense-in-depth measures against exploitation attempts.