Authorization Bypass in OpenEMR's FaxSMS Module Affects User Data Security

CVE-2026-33305

What is CVE-2026-33305?

The FaxSMS module in OpenEMR, a free and open-source electronic health records and medical practice management application, has a vulnerability that allows authenticated users to bypass proper authorizations. This flaw permits users to invoke specific controller methods, notably getNotificationLog(), which reveals sensitive patient appointment data, including protected health information (PHI), without holding the necessary access control list (ACL) permissions. The vulnerability stems from the way the AppDispatch constructor executes user-controlled actions, prematurely exiting before ACL checks are enforced. The issue has been addressed in version 8.0.0.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References