CVE-2026-34051 MEDIUM

CVE-2026-34051: OpenEMR has Improper ACL On Import/Export Popup

Vendor Openemr
Product openemr
Weakness CWE-285
Published March 25, 2026
Last update March 28, 2026

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.

Key dates

02Disclosure timeline

March 25, 2026 CVE published
March 28, 2026 Record updated