VulnerabilityAnalyzed

CVE-2026-34056

A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks.

MEDIUM 6.5EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-285, CWE-425
Affected: open-emr/openemr
Source: security-advisories@github.com

References

https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfhExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.