OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege authenticated user can iterate name prefixes and receive patient first and last names, dates of birth, gender, phone numbers, and email addresses in JSON responses. This issue is fixed in version 8.3.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…penemr/security/advisories/GHSA-xhfm-5pwg-3cxv Diğer
• github.com/openemr/openemr/pull/13200 Diğer
• github.com/…ommit/7973cab3fe3f2fd2374ed71c02605e3c93491c36 Diğer
• github.com/openemr/openemr/releases/tag/v8_3_0 Diğer

Kayıt geçmişi

1. 5 Kas 2026 23:03Yayımlandı

İlgili açıklar

• 9,6 CVE-2026-102940OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
• 5,3 CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
• 5,3 CVE-2026-103020OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
• 4,3 CVE-2026-103019OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
• 5,4 CVE-2026-103939OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
• 6,5 CVE-2026-104138OpenEMR: Missing authorization on QRDA Category I/III download endpoints