Authorization Bypass in OpenEMR Allows Deletion of Patient Records

CVE-2026-34053

What is CVE-2026-34053?

OpenEMR, an open-source electronic health records platform, is susceptible to an authorization bypass vulnerability that permits any authenticated user to delete procedure orders, answers, and specimens associated with any patient. This exploitation can lead to irreversible data loss, affecting patient records and overall system integrity. The issue is resolved in OpenEMR version 8.0.0.3, where proper authorization checks are implemented for the AJAX deletion endpoint.

References