Openemr
CVE-2026-34051
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible vulnerability requiring low privileges but with limited scope impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates the attack requires valid authentication credentials and low attack complexity, but the confidentiality and integrity impacts are rated as low rather than high. However, this baseline score significantly underrepresents real-world risk in healthcare contexts: unauthorized access to and modification of Electronic Health Records constitutes a serious breach with regulatory implications (HIPAA, GDPR), potential patient harm, and liability exposure. The vulnerability is not a theoretical information disclosure or minor UI bypass-it enables bulk exfiltration of sensitive patient data and unauthorized modifications to medical records. Given that OpenEMR is widely deployed in small to mid-size healthcare practices and the exploit requires only valid application credentials (not administrative access), the practical exploitability is high. Patch availability (version 8.0.0.3 released) reduces ongoing risk for patched systems, but many legacy OpenEMR deployments remain unpatched. This should be treated as a high-priority security issue despite the moderate CVSS score, particularly given the healthcare context and data sensitivity involved. |
| Exploit ScenarioDerived | An employee with basic user credentials in an OpenEMR-deployed medical practice identifies the import/export endpoint by inspecting network traffic or reviewing application documentation. The attacker crafts a direct HTTP POST request to the export endpoint with parameters for bulk patient data export, bypassing the UI restriction that normally limits export functionality to administrators. The backend fails to validate the user's authorization level for export operations and processes the request, returning a CSV file containing thousands of patient records including names, medical histories, diagnoses, and treatment information. The attacker exfiltrates this data, potentially for sale on underground markets or use in targeted fraud against patients. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
OpenEMR versions prior to 8.0.0.3 contain an improper access control vulnerability in the Import/Export functionality that allows authenticated users to bypass UI restrictions and perform unauthorized import and export operations through direct request manipulation. An attacker with valid credentials can extract bulk patient data, access sensitive health records, or modify system data despite not having explicit permissions for these actions. The vulnerability requires valid authentication (PR:L in CVSS) but enables significant data exfiltration and integrity violations once access is obtained.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the access control fix. The patched version is available from https://github.com/openemr/openemr/releases/tag/v8_0_0_3. Organizations unable to patch immediately should implement network-level access controls to restrict access to OpenEMR's import/export endpoints (typically /interface/import_export routes) to trusted administrative users or networks only, and enforce strong authentication with multi-factor authentication for all user accounts. Additionally, audit all import/export activities in system logs for the period prior to patching to identify any unauthorized data access or modifications. Regular backups of the database should be maintained to enable recovery if unauthorized modifications are detected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-285 (Improper Authorization) and represents a classic broken access control flaw where the application enforces restrictions only at the user interface layer rather than at the API or backend processing layer. OpenEMR's Import/Export functionality appears to rely on front-end UI controls to restrict which users can perform these sensitive operations, but the backend fails to re-validate authorization when direct HTTP requests are sent to the import/export endpoints. An authenticated attacker can circumvent these UI-enforced restrictions by crafting direct API requests, allowing them to interact with the import/export processing code without proper permission checks. The vulnerability affects OpenEMR (cpe:2.3:a:openemr:openemr) versions prior to 8.0.0.3, which is a PHP-based electronic health records and medical practice management system handling Protected Health Information (PHI).
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.
Executive ViewAI
Organizations using OpenEMR should be aware of moderate risk from CVE-2026-34051 rated CVSS 5.4. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OpenEMR Authorization and XSS Vulnerabilities
View all 6An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB