CVE-2026-34053CWE-862

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

High · published March 25, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-25T23:46Z
EPSS history
Timeline
  • 25 MAR 23:46Z
    OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler
    cvelistv5