CVE-2026-34051
OpenEMR has Improper ACL On Import/Export Popup
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
4th
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.
| CWE | CWE-285 CWE-425 |
| Vendor | openemr |
| Product | openemr |
| Published | Mar 25, 2026 |
| Last Updated | Mar 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for openemr openemr
Be the first to know when new medium vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
openemr / openemr
< 8.0.0.3