OpenEMR Vulnerability in Document Management and Patient Data Protection

CVE-2026-65983

What is CVE-2026-65983?

OpenEMR, a popular open-source electronic health records and medical practice management application, contains a vulnerability in its fax and SMS module. Specifically, prior to version 8.2.0, the implementation fails to securely manage patient documents when they are decrypted and stored for fax transmission. The module does not adequately restrict access to these files, allowing an unauthenticated external actor to access sensitive patient data through predictable URLs. This security flaw underscores the importance of robust access controls and proper data lifecycle management, especially in healthcare applications that handle sensitive information.

References