External risk intelligence

OpenEMR document reassignment vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-102940

OpenEMR is an electronic health record and practice management application typically deployed as a web-based service. While the vulnerability requires authentication, such platforms are commonly exposed to the internet to facilitate remote access for providers and staff, making the web interface a frequently internet-facing service.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpenEMR, a health records application, could allow a low-privilege user to reassign documents to different patients or categories. This reassignment happens before security checks, potentially exposing sensitive health information to unauthorized individuals through normal retrieval paths. The issue is fixed in version 8.4.0.

Unauthorized document reassignment in health records.
Protects patient data integrity and privacy.
Confirm relevance and verify exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to OpenEMR could exploit this vulnerability by manipulating document assignments. The application's document controller does not properly check the caller's permissions before reassigning documents. This allows an authenticated user to move any document to a different patient or category that they can access. Although a later check might return an error, the reassignment itself has already occurred, potentially exposing sensitive health information through the read path.

Authenticated user needed.
Reassign arbitrary documents.
Sensitive data exposure risk.

Live Threat

Current exploitation, exposure, and threat context

A low-privilege authenticated user could reassign documents to a different patient or category. This reassignment happens before access controls are fully enforced for document listing, potentially allowing unauthorized retrieval of sensitive medical information through normally protected read paths.

Medical documents associated with patients.
Unauthorized reassignment of documents.
Exposure of sensitive patient health information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenEMR application's owners and platform teams are responsible for addressing this vulnerability. The initial step is to locate all instances of OpenEMR, confirm their reachability and business criticality, identify the accountable owner, and then plan remediation according to risk.

OpenEMR application owners should lead.
Verify affected deployments and reachability.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenEMR?

OpenEMR is a free, open-source software platform used by medical practices to manage electronic health records (EHR) and administrative workflows. It functions as a web-based application, allowing healthcare providers to store, organize, and access patient charts, medical histories, and clinical documents securely.

What is the vulnerability in CVE-2026-102940?

This vulnerability is an instance of Authorization Bypass Through User-Controlled Key, classified as CWE-639. In this scenario, the software fails to verify if a user has permission to modify a specific document before moving it. This flaw allows a low-privilege user to reassign sensitive documents to a different patient record or category that they are authorized to view, effectively bypassing intended access restrictions.

How does an attacker trigger this flaw?

An attacker needs an authenticated, low-privilege account to perform the reassignment action. The vulnerability is triggered when the application processes a document move command without first checking the user's rights. Importantly, this bug is not triggered by public, unauthenticated access; the user must be logged into the system to initiate the unauthorized document movement.

Why is this relevant to my organization?

According to Halo Surface Signal, OpenEMR is commonly deployed as a web-based service, often making its interface accessible over the internet to support remote access for staff. Because this vulnerability allows a standard user to access documents they should not see, any organization using affected versions of OpenEMR that exposes its web portal to the internet or internal networks faces a risk to data privacy.

What should I do if I run OpenEMR?

First, identify all instances of OpenEMR within your environment and determine their business criticality. Confirm whether your current version is earlier than 8.4.0. If you are running an affected version, the primary step is to update the application to version 8.4.0 or later, where this vulnerability has been officially addressed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.