CVE-2026-33305
OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
MEDIUM 5.4EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.
- Affected
- openemr
- CVSS v3.1 GITHUB
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.32% chance of exploitation in the next 30 days, 23rd percentile
- Published
- 2026-03-19
- Updated
- 2026-03-21
Proof-of-concept exploits (1)
- exposelabniu/AMENDER-20260★ · 2026-09-30
Security advisories
- openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc
- openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11