What is the CVSS score of CVE-2026-34051?

CVE-2026-34051 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-34051?

Organizations using OpenEMR should be aware of moderate risk from CVE-2026-34051 rated CVSS 5.4. Exploitation could compromise the security of affected deployments.

Openemr CVE-2026-34051

MEDIUM

Improper Authorization (CWE-285)

2026-03-26 security-advisories@github.com

Authentication Bypass Openemr

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 00:22 vuln.today

CVE Published

Mar 26, 2026 - 00:16 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.

AnalysisAI

OpenEMR versions prior to 8.0.0.3 contain an improper access control vulnerability in the Import/Export functionality that allows authenticated users to bypass UI restrictions and perform unauthorized import and export operations through direct request manipulation. An attacker with valid credentials can extract bulk patient data, access sensitive health records, or modify system data despite not having explicit permissions for these actions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible vulnerability requiring low privileges but with limited scope impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An employee with basic user credentials in an OpenEMR-deployed medical practice identifies the import/export endpoint by inspecting network traffic or reviewing application documentation. The attacker crafts a direct HTTP POST request to the export endpoint with parameters for bulk patient data export, bypassing the UI restriction that normally limits export functionality to administrators. …
Remediation	Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the access control fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-34051 vulnerability details – vuln.today

Back