Openemr CVE-2026-34055

Authenticated user account required on OpenEMR versions prior to 8.0.0.3. Attacker with any valid login can modify or delete patient notes belonging to other patients via web UI by manipulating note IDs. No victim interaction needed.

This vulnerability presents a significant real-world risk to healthcare organizations using affected OpenEMR versions. The CVSS 3.1 score of 8.1 accurately reflects the severity with network-based attack vector (AV:N), low attack complexity (AC:L), and requiring only low-level privileges (PR:L). An authenticated attacker can achieve both high confidentiality and integrity impact without user interaction. While there is no evidence of active exploitation (not in CISA KEV) or public proof-of-concept availability, the vulnerability affects medical records which are highly sensitive and regulated under HIPAA and similar frameworks. The low attack complexity and the fact that many OpenEMR instances are internet-facing make this a practical threat. Healthcare data breaches carry significant financial, legal, and reputational consequences, elevating this beyond a theoretical risk despite the lack of observed exploitation. The availability of a patch in version 8.0.0.3 makes this immediately actionable for defenders.

An authenticated attacker with low-level privileges (such as a front desk staff member with limited patient access) logs into the OpenEMR web interface and intercepts or manipulates the note ID parameter in patient notes requests. By systematically iterating through note IDs or targeting specific high-value patient records, the attacker can read, modify, or delete confidential medical notes for any patient in the system regardless of whether they have legitimate access to those patients. This could enable data theft for blackmail, competitive intelligence, or manipulation of medical records to support fraudulent insurance claims or hide medical errors.