Improper Access Control in OpenEMR Affects Patient Data Management
CVE-2026-34055
What is CVE-2026-34055?
OpenEMR, a widely-used open-source electronic health records application, prior to version 8.0.0.3, contains an improper access control vulnerability in its legacy patient notes functionality. Specifically, the functions within library/pnotes.inc.php are susceptible to unauthorized access, as they perform updates and deletions based solely on the note ID provided by the user. This allows potential attackers to manipulate patient notes without proper authorization, directly impacting the integrity and confidentiality of sensitive health information. Affected systems should upgrade to version 8.0.0.3 or later to mitigate this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
openemr < 8.0.0.3