OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11 | Patch |
| https://github.com/openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc | Exploit Vendor Advisory |
Configurations
History
20 Mar 2026, 15:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* | |
| First Time |
Open-emr openemr
Open-emr |
|
| References | () https://github.com/openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11 - Patch | |
| References | () https://github.com/openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc - Exploit, Vendor Advisory |
19 Mar 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-19 21:17
Updated : 2026-03-20 15:05
NVD link : CVE-2026-33305
Mitre link : CVE-2026-33305
CVE.ORG link : CVE-2026-33305
JSON object : View
Products Affected
open-emr
- openemr