PT-2026-28155 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-34051

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. Improper access control on the Import/Export functionality in versions prior to 8.0.0.3 allows unauthorized users to perform import and export actions through direct request manipulation, bypassing UI restrictions. This can result in unauthorized data access, bulk data extraction, and manipulation of system data.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-425

Related Identifiers

CVE-2026-34051

GHSA-54M8-WPG9-9665

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34051.json · Exploit
• https://github.com/openemr/openemr/commit/81c097f7852fc60d45adf6c13baa86cd0a1b400b · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-54m8-wpg9-9665 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34051 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137776659890270 · Twitter Post