Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-05T20:17:37.877Z",
  "pubdate": "2026-11-05T20:17:37.877Z",
  "executiveSummary": "This vulnerability is an unauthenticated information disclosure flaw affecting the multisite administration functionality in OpenEMR versions prior to 8.3.0.\nThe vulnerability resides within the admin.php script, which fails to implement mandatory authentication checks before processing requests.\nAn unauthenticated network actor can exploit this oversight to extract sensitive system metadata, including site identifiers, database configurations, hostnames, and granular application versioning data.\nBy accessing the multisite configuration details, an attacker gains reconnaissance capabilities that facilitate targeted secondary attacks, such as identifying outdated instances vulnerable to known exploits or mapping internal network infrastructure.\nThe risk is significant due to the exposure of patient-portal links and site-specific operational details, which directly undermines the security posture of healthcare organizations relying on this software.\nThe vulnerability requires no prior authentication and can be exploited over the network by any actor capable of reaching the webroot.\nFull remediation requires upgrading the application to version 8.3.0 or later, where appropriate access control mechanisms have been enforced for the affected management interfaces.",
  "technicalDetails": "The vulnerability originates from a logic flaw within the admin.php component located in the webroot of the OpenEMR application. In versions prior to 8.3.0, the multisite administration script lacks an authentication verification layer, effectively allowing unauthenticated access to sensitive system management functions.\nUpon receiving an HTTP request, admin.php proceeds to invoke internal functions that read configuration parameters from sqlconf.php. The script then iterates through all configured multisite databases to extract comprehensive environment metadata. Because the script does not validate the session or user privileges, any network actor can trigger this execution flow simply by accessing the file through a standard browser or automated script.\nThe attack flow begins when an attacker sends a GET request to the vulnerable admin.php endpoint. The application processes this request and returns a detailed response containing sensitive site identifiers, database nomenclature, and associated site names. Furthermore, the application inadvertently reveals precise versioning information, including current patch levels and the status of pending system upgrades.\nThe exposure of this data is critical for post-exploitation reconnaissance. By identifying the exact version and patch level, an attacker can cross-reference the instance against a database of known CVEs to determine if the target is susceptible to remote code execution or SQL injection. Additionally, the disclosure of direct login URLs and patient-portal links provides attackers with the specific entry vectors required to conduct credential stuffing or phishing campaigns targeting administrative or clinical personnel.\nThe root cause is the absence of an authorization check at the beginning of the admin.php execution cycle. In a secure implementation, the script should invoke an authentication middleware or a session validation function to ensure the requester possesses the required 'admin' or equivalent privilege level before accessing site-wide configuration data. Because this check was missing, the application defaults to an open state, effectively leaking the entire multisite topology to any unauthenticated observer. The exposure extends to the backend infrastructure mapping, which significantly reduces the difficulty for an adversary to escalate their access or conduct further, more invasive operations against the underlying database servers."
}