CVE-2026-126447 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has a missing authorization check in trusted-messages-ajax.php. Any logged-in core user, even one with no ACL permissions, can send Direct messages through the clinic's phiMail credentials to chosen recipients with chosen content.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations running OpenEMR before 8.5.0 with the Direct messaging (phiMail) feature. Any authenticated core user can exploit it, including accounts without the patients/notes permission. Installations that do not use Direct messaging are unlikely to be exposed to the message sending path.
Not affected if no-direct-messaging, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected.8.5.0 or later (per the NVD description).OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.