PT-2026-28158 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-34056

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.4

Description OpenEMR is an electronic health records and medical practice management application. A Broken Access Control issue exists that allows users with limited privileges to view and download Ensora eRx error logs without authorization. This compromises the confidentiality of the system and could lead to unauthorized disclosure of sensitive information.

Recommendations Update to a version later than 8.0.0.3.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-425

CWE-285

Related Identifiers

CVE-2026-34056

GHSA-6QG7-6JF3-XRFH

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34056.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34056 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137773614801012 · Twitter Post