Vulnerability · Published Mar 25, 2026 · Assigned by GitHub_M

CVE-2026-34053OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

High 7.1

In plain English

A high-severity missing authorization in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 62.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
openemr	openemr	< 8.0.0.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/openemr/openemr/security/advisories/GHSA-3vvq-pfq6-pw98 x_refsource_CONFIRM
https://github.com/openemr/openemr/commit/7a16b731af7d34ffd92155fe2a5692fa1a67858e x_refsource_MISC
https://github.com/openemr/openemr/releases/tag/v8_0_0_3 x_refsource_MISC