Openemr CVE-2026-34056

Requires low-privilege authenticated user account in OpenEMR versions up to 8.0.0.3. Attacker can remotely access Ensora eRx error logs via network without victim interaction. Affects installations with Ensora eRx integration enabled.

The CVSS 7.7 score reflects a high confidentiality impact with changed scope (S:C), indicating the vulnerability can affect resources beyond the vulnerable component. However, real-world exploitation risk appears moderate based on multiple signals: the 3% EPSS score places it in the 8th percentile, suggesting low observed exploitation probability; the attack requires network access (AV:N) but also requires low-level authentication (PR:L), limiting the attack surface to existing users; attack complexity is low (AC:L) with no user interaction needed (UI:N), making it technically straightforward once authenticated access is obtained. No public exploit or KEV listing exists, further reducing immediate risk. The primary concern is the confidentiality breach (C:H) in healthcare environments where error logs may contain Protected Health Information (PHI) or system details useful for reconnaissance. This is a real priority for OpenEMR deployments handling sensitive data, but not a critical emergency requiring immediate weekend patching given the authentication requirement and low observed exploitation probability.

An authenticated attacker with low-privilege credentials (such as a front-desk staff account or compromised limited-access user) connects to the OpenEMR web interface over the network and directly navigates to the Ensora eRx error log endpoints. Because the application fails to verify whether the user has authorization to view these logs, the attacker successfully downloads error files containing prescription transaction failures, patient identifiers, pharmacy information, and internal system details. The attacker uses this information for reconnaissance to plan further attacks, sells the data on dark web markets, or exploits the exposed credentials or API tokens found in error messages.