CVE-2026-102940

    Dashboard / Vulnerabilities / CVE-2026-102940

    CVE-2026-102940

    Published: 5 Nov 2026Last Modified: 8 Nov 2026

    Summary: OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

    Details: OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.

    References: https://github.com/openemr/openemr/releases/tag/v8_3_0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102940.json, https://github.com/openemr/openemr/security/advisories/GHSA-92rh-g949-4mvv, https://nvd.nist.gov/vuln/detail/CVE-2026-102940, https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c, https://github.com/openemr/openemr/pull/13353

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -53d885e56d4772b4e48810a1f98531c5d19a934d

    Affected versions

    v3_0_1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-102940 | CVE-DB