PT-2026-28158 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-34056

Positive Technologies · (AI Summary)

CVSS v3.1

7.7

High

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.4

Description OpenEMR is an electronic health records and medical practice management application. A Broken Access Control issue exists that allows users with limited privileges to view and download Ensora eRx error logs without authorization. This compromises the confidentiality of the system and could lead to unauthorized disclosure of sensitive information.

Recommendations Update to a version later than 8.0.0.3.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-425

Related Identifiers

CVE-2026-34056

Affected Products

Openemr

References · 4

• https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34056 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137773614801012 · Twitter Post