Skip to content
OpenAdvisories
High · 7.1 CVE-2026-34053 EUVD-2026-16046

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

Published Mar 25, 2026 · Updated Mar 26, 2026 · Assigned by GitHub_M

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.

Affected products

VendorProductAffectedFixed
openemr openemr < 8.0.0.3 —

References