CVE-2026-34053

HIGH

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

Title source: cna
STIX 2.1

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

References (3)

Core 3

Scores

CVSS v3 7.1
EPSS 0.0042
EPSS Percentile 32.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
open-emr/openemr < 8.0.0.3
openemr/openemr < 8.0.0.3
Published Mar 26, 2026
Tracked Since Mar 26, 2026