Openemr
CVE-2026-34051
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.
AnalysisAI
OpenEMR versions prior to 8.0.0.3 contain an improper access control vulnerability in the Import/Export functionality that allows authenticated users to bypass UI restrictions and perform unauthorized import and export operations through direct request manipulation. An attacker with valid credentials can extract bulk patient data, access sensitive health records, or modify system data despite not having explicit permissions for these actions. The vulnerability requires valid authentication (PR:L in CVSS) but enables significant data exfiltration and integrity violations once access is obtained.
Technical ContextAI
This vulnerability is classified as CWE-285 (Improper Authorization) and represents a classic broken access control flaw where the application enforces restrictions only at the user interface layer rather than at the API or backend processing layer. OpenEMR's Import/Export functionality appears to rely on front-end UI controls to restrict which users can perform these sensitive operations, but the backend fails to re-validate authorization when direct HTTP requests are sent to the import/export endpoints. An authenticated attacker can circumvent these UI-enforced restrictions by crafting direct API requests, allowing them to interact with the import/export processing code without proper permission checks. The vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr) versions prior to 8.0.0.3, which is a PHP-based electronic health records and medical practice management system handling Protected Health Information (PHI).
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the access control fix. The patched version is available from https://github.com/openemr/openemr/releases/tag/v8_0_0_3. Organizations unable to patch immediately should implement network-level access controls to restrict access to OpenEMR's import/export endpoints (typically /interface/import_export routes) to trusted administrative users or networks only, and enforce strong authentication with multi-factor authentication for all user accounts. Additionally, audit all import/export activities in system logs for the period prior to patching to identify any unauthorized data access or modifications. Regular backups of the database should be maintained to enable recovery if unauthorized modifications are detected.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today