Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-34056

OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are av
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c7790ca680cc8c1afdcad8624ba5c813131afd20b3868c944218d3a594c4dd67
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-285","description":"CWE-285: Improper Authorization","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-425","description":"CWE-425: Direct Request ('Forced Browsing')","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion
{"product":"openemr","vendor":"openemr","versions":[{"status":"affected","version":"<= 8.0.0.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-285","description":"CWE-285: Improper Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-425","description":"CWE-425: Direct Request ('Forced Browsing')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/problemTypes/1/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/openemr/openemr/releases/tag/v8_0_0_3","tags":["x_refsource_MISC"],"url":"https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/references/1
{"name":"https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6qg7-6jf3-xrfh"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:44aeef047bc5ff43aa7293c8fe639a916b34bafd057737788b2801c10ad68a2c · sha256:fbe77c7debe36bd3… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer