OpenEMR versions earlier than 8.3.0 allow an unauthenticated user to access the multisite administration page at admin.php, which lacks an authentication check. The page reads database configuration data from sqlconf.php and connects to each site’s database. As a result, an attacker can obtain site identifiers, database names, site names, exact OpenEMR version and patch level, pending upgrade status, and direct links for login and patient portal. This information disclosure falls under CWE‑200 and is further enabled by missing authentication (CWE‑306). The data revealed could aid in targeted attacks or insider threat acceptance but does not grant direct control over the system.

All installations of OpenEMR prior to release 8.3.0 are affected. The vulnerability applies to the openemr:openemr product across all supported platforms that enable admin.php without authentication. No specific operating system or database version constraints are listed, meaning any build that uses the multisite admin interface is at risk until the vendor releases the fix.

The CVSS base score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The attack vector is likely remote via the web interface, requiring no prior authentication. Because the compromised information is largely passive, the main value to an attacker is reconnaissance and foothold for further exploitation. The rational risk for organizations is the potential exposure of sensitive configuration data and the use of that data to craft subsequent attacks. Freshly compromised systems should monitor for abnormal access patterns, but the primary remediation is to patch.