Openemr
CVE-2026-34053
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any OpenEMR user
-
DeliveryAccess AJAX deletion endpoint
-
ExploitSend crafted DELETE request
-
ExecutionBypass authorization checks
-
ImpactIrreversibly delete procedure orders across patients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to OpenEMR versions prior to 8.0.0.3. Any authenticated user regardless of role can remotely delete procedure orders, answers, and specimens for any patient via the AJAX endpoint interface/forms/procedure_order/handle_deletions.php. No victim interaction needed. |
| Impact | The CVSS v3.1 score of 7.1 (High) reflects network accessibility (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and high integrity impact (I:H) with low availability impact (A:L). Any authenticated user can exploit this without special privileges, making it highly accessible to insider threats or compromised low-privilege accounts. The high integrity impact is particularly severe in healthcare contexts where irreversible deletion of medical procedure data could affect patient care and violate HIPAA compliance. The attack is straightforward requiring only authenticated access and knowledge of the vulnerable endpoint. While no EPSS score or KEV status indicates current exploitation, the simplicity of exploitation combined with the sensitive nature of healthcare data and the public availability of patch details in GitHub commits (7a16b731af7d34ffd92155fe2a5692fa1a67858e) significantly elevates real-world risk. Organizations running OpenEMR should prioritize this patch due to the potential for data loss and regulatory implications. |
| Exploit ScenarioDerived | An attacker with any valid low-privilege account in OpenEMR (such as a receptionist or billing clerk) discovers the unprotected AJAX endpoint at interface/forms/procedure_order/handle_deletions.php. By crafting direct HTTP requests to this endpoint with procedure order IDs obtained through normal system access or enumeration, the attacker can systematically delete procedure orders, test results, and specimen records for any patient in the database, causing irreversible data loss and potentially disrupting patient care workflows. The attack requires no special tools beyond a web browser or HTTP client and low attack complexity makes it easily reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
OpenEMR versions prior to 8.0.0.3 contain a missing authorization vulnerability in the AJAX deletion endpoint that allows any authenticated user, regardless of assigned role or privileges, to irreversibly delete critical medical data including procedure orders, answers, and specimens for any patient in the system. This is a severe integrity violation in a healthcare application handling protected health information. No evidence of active exploitation (not in CISA KEV) is currently available, though patches have been released.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later immediately, as documented in the release notes at https://github.com/openemr/openemr/releases/tag/v8_0_0_3. The specific fix can be reviewed in commit 7a16b731af7d34ffd92155fe2a5692fa1a67858e at https://github.com/openemr/openemr/commit/7a16b731af7d34ffd92155fe2a5692fa1a67858e. As an interim mitigation if immediate patching is not possible, consider implementing network-level access controls to restrict access to the interface/forms/procedure_order/handle_deletions.php endpoint to only administrative users via web application firewall rules, though this is not a substitute for proper application-level authorization. Review audit logs for any suspicious deletion activity in procedure order tables prior to patching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenEMR is an open-source electronic health records and medical practice management application written in PHP. The vulnerability exists in the file interface/forms/procedure_order/handle_deletions.php, an AJAX endpoint that processes deletion requests. The root cause is CWE-862 (Missing Authorization), meaning the endpoint fails to verify whether the authenticated user has appropriate permissions to delete the requested resources before executing the deletion operation. This represents a classic broken access control flaw where authentication alone is considered sufficient, without proper authorization checks to validate that the user has the necessary privileges to perform destructive operations on sensitive medical data.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint interface/forms/procedure_order/handle_deletions.php allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.
Executive ViewAI
OpenEMR instances are vulnerable to unauthorized deletion of critical patient medical records by any authenticated user, regardless of their assigned permissions. This represents a direct threat to data integrity, patient safety, regulatory compliance (HIPAA), and organizational liability in healthcare operations.
Implement WAF rules blocking unauthorized access to AJAX deletion endpoints; network segmentation restricting OpenEMR access to authorized personnel only; disable the affected AJAX deletion functionality if operationally feasible; enable and monitor comprehensive audit logs for all data modifications; implement database-level access controls limiting deletion privileges; enforce multi-factor authentication for all OpenEMR users; consider read-only replica of patient records for recovery purposes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OpenEMR Authorization and XSS Vulnerabilities
View all 6An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB