Dashboard / CVE-2026-104137

CVE-2026-104137

HIGH
MEDIUM Priority: 0.03 BB Relevance: 64/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
open-emr openemr < 8.3.0
openemr openemr < 8.3.0
openemr openemr < 8.3.0

References & Advisories (4)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.37%
Raw Score 0.003710
Percentile 31.5%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00371
2026-11-13
0.00371
2026-11-12
0.00371
2026-11-10
0.00313
2026-11-09
0.00313
2026-11-08
0.00313
2026-11-07
0.00313
2026-11-06
0.00313

Intelligence Sources

mitre ref →
nvd ref →

External Links