CVE-2026-34051

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.4

EPSS

0.21%

Published

Mar 25, 2026

Modified

Mar 26, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-285CWE-425

Affected Products (1)

open-emr · openemr (up to 8.0.0.3)vulnerable

References (3)

https://github.com/openemr/openemr/commit/81c097f7852fc60d45adf6c13baa86cd0a1b400b

Patch

https://github.com/openemr/openemr/releases/tag/v8_0_0_3

Product

https://github.com/openemr/openemr/security/advisories/GHSA-54m8-wpg9-9665

ExploitVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs