CVE-2026-34056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34056", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T15:29:04.747Z", "datePublished": "2026-03-25T23:53:15.789Z", "dateUpdated": "2026-03-28T01:53:13.991Z"}, "containers": {"cna": {"title": "OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-425", "lang": "en", "description": "CWE-425: Direct Request ('Forced Browsing')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh"}, {"name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "<= 8.0.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:53:15.789Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available."}], "source": {"advisory": "GHSA-6qg7-6jf3-xrfh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-28T01:52:52.463511Z", "id": "CVE-2026-34056", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-28T01:53:13.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34056", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-28T01:52:52.463511Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-28T01:53:08.881Z"}}], "cna": {"title": "OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data", "source": {"advisory": "GHSA-6qg7-6jf3-xrfh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "<= 8.0.0.3"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-425", "description": "CWE-425: Direct Request ('Forced Browsing')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T23:53:15.789Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34056", "state": "PUBLISHED", "dateUpdated": "2026-03-28T01:53:13.991Z", "dateReserved": "2026-03-25T15:29:04.747Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T23:53:15.789Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "<= 8.0.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "212E854F-1A4F-46BD-AF78-20E4931F574D", "versionEndIncluding": "8.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. Una vulnerabilidad de control de acceso roto en OpenEMR hasta la versi\u00f3n 8.0.0.3 inclusive permite a usuarios con bajos privilegios ver y descargar registros de errores de Ensora eRx sin las comprobaciones de autorizaci\u00f3n adecuadas. Esta falla compromete la confidencialidad del sistema al exponer informaci\u00f3n sensible, lo que podr\u00eda llevar a la divulgaci\u00f3n no autorizada de datos y su uso indebido. Al momento de la publicaci\u00f3n, no hay versiones de parches conocidas disponibles."}], "id": "CVE-2026-34056", "lastModified": "2026-06-17T10:38:29.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34056", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-28T01:52:52.463511Z", "version": "2.0.3"}}]}, "published": "2026-03-26T00:16:41.400", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-425"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-26T17:35:43.690311+00:00", "value": {"mitigation_remediation": ["Seek and apply an updated OpenEMR release that fixes the access control issue (once available).", "If an update is not yet released, reconfigure access controls so that only admin or privileged users can view or download Ensora eRx error logs, for example by adjusting permissions or role settings.", "Temporarily disable or remove the Ensora eRx error log feature until a patch is available, to prevent accidental data exposure.", "Review user accounts and reduce privileges where appropriate to limit potential data exposure by low\u2011level users.", "Continuously monitor system logs for unauthorized access attempts and keep the overall system updated with the latest security patches."], "summary": {"action": "Assess Impact", "impact": "Unauthorized disclosure of sensitive medical records via low\u2011privilege access to error logs"}, "threat_synthesis": {"affected_systems": "The flaw affects the OpenEMR electronic health record system, specifically all releases up to and including version\u202f8.0.0.3. Any deployment of those versions that stores Ensora eRx error logs is at risk. No patched version is currently available, so installations remain vulnerable until the vendor publishes a fix.", "description_and_impact": "OpenEMR has a broken access control flaw that permits users with low\u2011level privileges to view and download Ensora eRx error logs. The logs contain confidential patient and prescription data, so the vulnerability results in the unauthorized disclosure of sensitive information. This is a classic privilege\u2011escalation problem (CWE\u2011285) combined with accidental data exposure (CWE\u2011425).", "risk_and_exploitability": "The CVSS score of\u202f7.7 indicates a high\u2011to\u2011medium severity. EPSS is under\u202f1\u202f%, suggesting a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be a legitimate user with low privileges in the system, making the threat most acute for organizations with many low\u2011privilege accounts that are not properly isolated. If exploited, the attacker could read confidential medical information, potentially leading to privacy violations and regulatory noncompliance."}}}}, "created": "2026-03-26T11:31:02.188235+00:00", "updated": "2026-03-27T09:29:13.542505+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}