What is the CVSS score of CVE-2026-34053?

CVE-2026-34053 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34053?

OpenEMR instances are vulnerable to unauthorized deletion of critical patient medical records by any authenticated user, regardless of their assigned permissions.

How to fix or mitigate CVE-2026-34053?

Within 24 hours: Inventory all OpenEMR deployments and confirm versions below 8.0.0.3; restrict AJAX endpoint access via network controls or WAF rules; audit recent deletion logs for suspicious activity. Within 7 days: Implement role-based access controls at the network layer; enable comprehensive audit logging; conduct incident investigation if deletions are detected. Within 30 days: Upgrade to OpenEMR 8.0.0.3 or later; perform full data integrity audit; update access policies to enforce principle of least privilege.

PHP CVE-2026-34053

HIGH

Missing Authorization (CWE-862)

2026-03-26 security-advisories@github.com

PHP Authentication Bypass

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 00:22 vuln.today

CVE Published

Mar 26, 2026 - 00:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint interface/forms/procedure_order/handle_deletions.php allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

AnalysisAI

OpenEMR versions prior to 8.0.0.3 contain a missing authorization vulnerability in the AJAX deletion endpoint that allows any authenticated user, regardless of assigned role or privileges, to irreversibly delete critical medical data including procedure orders, answers, and specimens for any patient in the system. This is a severe integrity violation in a healthcare application handling protected health information. No evidence of active exploitation (not in CISA KEV) is currently available, though patches have been released.

Technical ContextAI

OpenEMR is an open-source electronic health records and medical practice management application written in PHP. The vulnerability exists in the file interface/forms/procedure_order/handle_deletions.php, an AJAX endpoint that processes deletion requests. The root cause is CWE-862 (Missing Authorization), meaning the endpoint fails to verify whether the authenticated user has appropriate permissions to delete the requested resources before executing the deletion operation. This represents a classic broken access control flaw where authentication alone is considered sufficient, without proper authorization checks to validate that the user has the necessary privileges to perform destructive operations on sensitive medical data.

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later immediately, as documented in the release notes at https://github.com/openemr/openemr/releases/tag/v8_0_0_3. The specific fix can be reviewed in commit 7a16b731af7d34ffd92155fe2a5692fa1a67858e at https://github.com/openemr/openemr/commit/7a16b731af7d34ffd92155fe2a5692fa1a67858e. As an interim mitigation if immediate patching is not possible, consider implementing network-level access controls to restrict access to the interface/forms/procedure_order/handle_deletions.php endpoint to only administrative users via web application firewall rules, though this is not a substitute for proper application-level authorization. Review audit logs for any suspicious deletion activity in procedure order tables prior to patching.