Broken Access Control in OpenEMR Affects Sensitive Health Records
CVE-2026-34056

7.7HIGH

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
25 March 2026

What is CVE-2026-34056?

OpenEMR, a widely-used electronic health records and practice management software, suffers from a broken access control vulnerability allowing low-privilege users to access and download sensitive Ensora eRx error logs without proper authorization. This weakness can lead to unauthorized disclosure of sensitive health information, raising significant concerns about system confidentiality and data integrity. As of the latest updates, there are no patches available to mitigate this risk, emphasizing the urgent need for users to assess their systems and implement security measures.

Affected Version(s)

openemr <= 8.0.0.3

References

https://github.com/openemr/openemr/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openemr/openemr/releases/tag/v8_0_0_3
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.