Signal is active with 16 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE openemr: document reassignment via missing write ACL check (CVE-2026-102940) A low-privilege user can reassign any document to a patient or category they can access, then retrieve it. Patch → 8.4.0 https://cve.now/CVE-2026-102940?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940 (CRITICAL / 9.6) — @OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0,... https://nvd.nist.gov/vuln/detail/CVE-2026-102940 #php #cve #kkaasolutions
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity
CVE-2026-102940: CVSS 9.6 critical advisory is out OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or. https://github.com/openemr/openemr/commit/312b5d042f7fa49cc78ebed041155fba339a991c #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #WordPress #WebSecurity