Is CVE-2026-102940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102940 being exploited in the wild.

How severe is CVE-2026-102940?

Critical severity, with a CVSS score of 9.6, published 5 November 2026.

Is there a fix for CVE-2026-102940?

Yes: fixed in 8.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102940 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102940?

Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102940: OpenEMR authorization bypass in document reassignment

CVE-2026-102940 · Severity: critical · CVSS 9.6 · Published 2026-11-05

OpenEMR is an electronic health records system used by medical practices to manage patient data and documents. A low-privilege user with access to the system could reassign patient documents to different patients or categories they should not have access to, potentially viewing protected medical records. An attacker could exploit this before the system's access checks prevent the action, allowing unauthorized access to sensitive health information.

Technologies: OpenEMR. Vendors: OpenEMR.

Quick answers

Is CVE-2026-102940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102940 being exploited in the wild.
How severe is CVE-2026-102940?: Critical severity, with a CVSS score of 9.6, published 5 November 2026.
Which products and versions are affected?: OpenEMR prior to 8.4.0.
Is there a fix for CVE-2026-102940?: Yes: fixed in 8.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102940 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102940?: Check whether you run OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.4.0

Technical details

The vulnerability is an authorization bypass in C_Document.class.php where the move_action_process() function fails to verify the caller's access to the source and destination documents, patients, and categories before calling Document::change_patient(). A low-privilege authenticated user can reassign an arbitrary document to an accessible patient or category and then retrieve it through protected read paths; the final HTTP 403 response does not prevent the unauthorized write. The fix adds ACL checks and source-document accessibility verification before any mutation occurs.

Affected products

OpenEMR OpenEMR prior to 8.4.0

Timeline

2026-11-05: disclosed
2026-08-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.