{"id":"CVE-2026-104138","aliases":["EUVD-2026-117773","GHSA-6p9h-59cp-8hxj"],"status":"published","title":"OpenEMR: Missing authorization on QRDA Category I/III download endpoints","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00371,"percentile":0.31451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-05T20:01:53Z","modified":"2026-11-10T19:12:22Z","products":[{"vendor":"open-emr","product":"openemr"},{"vendor":"openemr","product":"openemr"}],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6p9h-59cp-8hxj","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/openemr/openemr/pull/13200","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/openemr/openemr/releases/tag/v8_3_0","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104138.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104138","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104138","title":"OpenEMR: Missing authorization on QRDA Category I/III download endpoints","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.","status":"published","published":"2026-11-05T20:01:53.106Z","modified":"2026-11-09T18:15:21.739Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T19:34:28.960398Z"}],"euvd":[{"id":"EUVD-2026-117773","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.","status":"published","published":"2026-11-05T20:01:53Z","modified":"2026-11-09T18:15:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-09T19:17:50.030863Z"}],"nvd":[{"id":"CVE-2026-104138","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.","status":"published","published":"2026-11-05T20:17:39.45Z","modified":"2026-11-10T19:12:22.99Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-10T22:21:31.633178Z"}],"osv":[{"id":"CVE-2026-104138","title":"OpenEMR: Missing authorization on QRDA Category I/III download endpoints","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.","status":"published","published":"2026-11-05T20:01:53.106Z","modified":"2026-11-12T02:47:37.17513464Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-07T03:07:59.573031Z"}]}}