CVE-2026-126420 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR's FaxSMS module fails to check permissions in utility.php, so users with read-only demographics access can create patient charts. An attacker can use this to add fictitious or duplicate patients with employer, history and insurance records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organisations running OpenEMR before 8.5.0 with the FaxSMS module, where users have read-only demographics access. The sources do not say whether the module is on by default. Installations on 8.5.0 or later are not affected.
Not affected if openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0.8.5.0 or later.OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.