CVE-2026-34053 Details
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.
A vulnerability exists in OpenEMR versions prior to 8.0.0.3, where the AJAX deletion endpoint for procedure orders lacks proper authorization. This flaw allows any authenticated user, regardless of their role, to permanently delete procedure orders, answers, and specimens for any patient. The endpoint only verifies the CSRF token and requires an authenticated session, but fails to check user roles or validate that the specified order or specimen IDs belong to the patient in the current session. This issue can be exploited by users with minimal privileges, such as front-desk accounts.
Users can update to OpenEMR version 8.0.0.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openemr/openemr/security/advisories/GHSA-3vvq-pfq6-pw98 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/openemr/openemr/commit/7a16b731af7d34ffd92155fe2a5692fa1a67858e | [email protected] | Patch |
| https://github.com/openemr/openemr/releases/tag/v8_0_0_3 | [email protected] | Product |
| https://github.com/openemr/openemr/security/advisories/GHSA-3vvq-pfq6-pw98 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.0.0.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |