CVE-2026-34056: OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data
OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34056?
CVE-2026-34056 has a high severity level due to its potential for privilege escalation.
How do I fix CVE-2026-34056?
To fix CVE-2026-34056, upgrade OpenEMR to version 8.0.0.4 or later.
Who is affected by CVE-2026-34056?
CVE-2026-34056 affects all versions of OpenEMR up to and including version 8.0.0.3.
What type of vulnerability is CVE-2026-34056?
CVE-2026-34056 is classified as a Broken Access Control vulnerability.
What can low-privilege users do in CVE-2026-34056?
Low-privilege users can exploit CVE-2026-34056 to view admin-only data.