CVE-2026-34055

Katalog CVE

CVSS 6.3 · Medium EPSS 0,36%

Kerentanan Authorization Bypass Through User-Controlled Key pada open-emr openemr. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes functions in `library/pnotes.inc.php` perform updates and deletes using `WHERE id = ?` without verifying that the note belongs to a patient the user is authorized to access. Multiple web UI callers pass user-controlled note IDs directly to these functions. This is the same class of vulnerability as CVE-2026-25745 (REST API IDOR), but affects the web UI code paths. Version 8.0.0.3 patches the issue.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openemr/openemr/security/advisories/GHSA-8gj5-r8vm-mghq advisory vendor
• https://github.com/openemr/openemr/commit/214c9b4585a6f1c8c22750172d47f0e258fec0bf patch
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 product