CVE-2026-34051

OpenEMR has Improper ACL On Import/Export Popup

State: Published
Severity: 5.4 Medium
Published: Mar 25, 2026
Updated: Mar 28, 2026
Reserved: Mar 25, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-285 Improper Authorization
CWE-425 Direct Request ('Forced Browsing')

Affected Products

Product	Versions
openemropenemr	< 8.0.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.