CVE-2026-34053

Published: Mar 26, 2026Modified: Mar 26, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

Affected (1)

Products: Open Emr: Openemr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Open Emr Openemr	Before 8.0.0.3

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/openemr/openemr/commit/7a16b731af7d34ffd92155fe2a5692fa1a67858e

Source: security-advisories@github.com

Patch

https://github.com/openemr/openemr/releases/tag/v8_0_0_3

Source: security-advisories@github.com

Product

https://github.com/openemr/openemr/security/advisories/GHSA-3vvq-pfq6-pw98

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/openemr/openemr/security/advisories/GHSA-3vvq-pfq6-pw98

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.