← CVE Radar
CVE-2026-104138OpenEMR: Missing authorization on QRDA Category I/III download endpoints
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.
6.5 MEDIUMEPSS 0.30%Not in KEVNVD: Awaiting Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.5 | MEDIUM | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Details
- CVE ID
- CVE-2026-104138
- Status
- Awaiting Analysis
- Assigner (CNA)
- GitHub_M
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 21:29 UTC
- Weaknesses
- CWE-862 · Missing Authorization
Affected Products
As published by the CNA in the CVE record.
openemropenemr1 version range
- < 8.3.0