Improper Access Control in OpenEMR Affects Patient Data Management

CVE-2026-34055

What is CVE-2026-34055?

OpenEMR, a widely-used open-source electronic health records application, prior to version 8.0.0.3, contains an improper access control vulnerability in its legacy patient notes functionality. Specifically, the functions within library/pnotes.inc.php are susceptible to unauthorized access, as they perform updates and deletions based solely on the note ID provided by the user. This allows potential attackers to manipulate patient notes without proper authorization, directly impacting the integrity and confidentiality of sensitive health information. Affected systems should upgrade to version 8.0.0.3 or later to mitigate this vulnerability.

References