CVE-2026-34056
Broken Access Control in OpenEMR Allows Unauthorized Log Access
Publication date: 2026-03-26
Last updated on: 2026-03-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open-emr | openemr | to 8.0.0.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-425 | The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34056 is a high-severity vulnerability in OpenEMR, an electronic health records application. It is caused by broken access control that allows low-privilege users, such as physician-level accounts, to bypass role-based restrictions and view or download administrative-only Ensora eRx error logs without proper authorization.
This flaw arises because the system fails to enforce proper authorization checks (CWE-285) and does not adequately protect restricted URLs or files against unauthorized access (CWE-425).
The vulnerability can be exploited remotely over the network with low attack complexity, requiring only low privileges and no user interaction.
How can this vulnerability impact me? :
This vulnerability compromises system confidentiality by exposing sensitive information contained in the Ensora eRx error logs to unauthorized users.
Unauthorized access to these logs can lead to data disclosure and misuse, potentially exposing sensitive patient or system information.
The impact is limited to confidentiality loss, with no effect on data integrity or availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if low-privilege users are able to access the administrative-only Ensora eRx error logs without proper authorization.
Specifically, you can test access to the affected URL: https://demo.openemr.io/openemr/interface/logview/erx_logview.php using a low-privilege account.
Commands to detect this might include using curl or wget to attempt to access the URL with credentials of a low-privilege user and observing if the logs are accessible.
- curl -u lowprivuser:password "https://your-openemr-server/openemr/interface/logview/erx_logview.php" -v
- wget --user=lowprivuser --password=password "https://your-openemr-server/openemr/interface/logview/erx_logview.php"
If the response contains the error logs or does not return an authorization error, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
As no patched versions are available at the time of the advisory, immediate mitigation steps should focus on restricting access to the affected resource.
- Restrict access to the URL /openemr/interface/logview/erx_logview.php by implementing network-level controls such as firewall rules or web server access controls to allow only authorized administrative users.
- Review and tighten role-based access controls within OpenEMR to ensure low-privilege users cannot access administrative logs.
- Monitor access logs for any unauthorized attempts to access the error logs.
These steps help reduce the risk of unauthorized data disclosure until an official patch is released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability compromises system confidentiality by allowing unauthorized access to sensitive information contained in Ensora eRx error logs. Such unauthorized data disclosure can lead to misuse of protected health information.
Because OpenEMR is an electronic health records system, exposure of sensitive health data due to broken access control may result in non-compliance with regulations like HIPAA, which mandates strict protection of patient health information.
Similarly, the unauthorized disclosure of personal data could violate GDPR requirements for data confidentiality and protection, potentially leading to regulatory penalties.