{"id":"CVE-2026-126447","kind":"vulnerability","aliases":["CVE-2026-126447"],"related":[],"title":"OpenEMR: authenticated users can send clinic Direct messages without permission","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.","summary":"OpenEMR before 8.5.0 has a missing authorization check in trusted-messages-ajax.php. Any logged-in core user, even one with no ACL permissions, can send Direct messages through the clinic's phiMail credentials to chosen recipients with chosen content.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-direct-messaging","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review user accounts with no ACL permissions to see whether they can reach trusted-messages-ajax.php.","fix":"- OpenEMR: move to `8.5.0` or later (per the NVD description).","status":"open","published_at":"2026-11-13T10:17:52+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","triaged_at":"2026-11-13T10:56:32+00:00","updated_at":"2026-11-13T10:56:32+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:56:32Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later (per the NVD description).","reach":"network","title":"OpenEMR: authenticated users can send clinic Direct messages without permission","impact":"medium","summary":"OpenEMR before 8.5.0 has a missing authorization check in trusted-messages-ajax.php. Any logged-in core user, even one with no ACL permissions, can send Direct messages through the clinic's phiMail credentials to chosen recipients with chosen content.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker sends fraudulent clinical messages impersonating the clinic","analyst_note":"Product_name and ecosystem not given; the affected feature may need confirming against vendor advisory on github.com.","how_to_check":"- Check the OpenEMR version in use; versions before `8.5.0` are listed as affected.\n- Review user accounts with no ACL permissions to see whether they can reach trusted-messages-ajax.php.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-direct-messaging"],"who_is_affected":"Clinics and organizations running OpenEMR before 8.5.0 with the Direct messaging (phiMail) feature. Any authenticated core user can exploit it, including accounts without the patients/notes permission. Installations that do not use Direct messaging are unlikely to be exposed to the message sending path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4634,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126447':13A,16A '-2026':12A,15A '8.5.0':25B,63C 'account':90C 'acl':43B,89C 'allow':72C 'attack':85C 'authent':2A,74C 'author':29B,67C 'bodi':97C 'check':30B 'chosen':56B,59B,93C 'clinic':6A,51B,101C,107C,111C 'communic':112C 'contain':64C 'content':60B 'core':37B,75C 'credenti':54B,104C 'cve':11A,14A 'deliv':109C 'direct':7A,47B,79C 'even':39B 'fraudul':110C 'healthcar':17B 'host':22B 'imperson':105C 'log':35B 'logged-in':34B 'messag':8A,48B,80C,96C 'miss':28B,66C 'one':40B 'openemr':1A,18B,23B,61C 'patients/notes':83C 'permiss':10A,44B,84C 'phimail':53B,103C 'recipi':57B,94C 'self':21B 'self-host':20B 'send':5A,46B,78C 'sent':98C 'submit':92C 'trusted-messages-ajax.php':32B,70C 'user':3A,38B,76C 'via':99C 'vulner':68C 'without':9A,81C 'zero':88C 'zero-acl':87C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations running OpenEMR before 8.5.0 with the Direct messaging (phiMail) feature. Any authenticated core user can exploit it, including accounts without the patients/notes permission. Installations that do not use Direct messaging are unlikely to be exposed to the message sending path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126447':13A,16A '-2026':12A,15A 'authent':2A 'clinic':6A 'cve':11A,14A 'direct':7A 'messag':8A 'openemr':1A 'permiss':10A 'send':5A 'user':3A 'without':9A","search_b":"'8.5.0':25B 'acl':43B 'author':29B 'check':30B 'chosen':56B,59B 'clinic':51B 'content':60B 'core':37B 'credenti':54B 'direct':47B 'even':39B 'healthcar':17B 'host':22B 'log':35B 'logged-in':34B 'messag':48B 'miss':28B 'one':40B 'openemr':18B,23B 'permiss':44B 'phimail':53B 'recipi':57B 'self':21B 'self-host':20B 'send':46B 'trusted-messages-ajax.php':32B 'user':38B","search_c":"'8.5.0':63C 'account':90C 'acl':89C 'allow':72C 'attack':85C 'authent':74C 'author':67C 'bodi':97C 'chosen':93C 'clinic':101C,107C,111C 'communic':112C 'contain':64C 'core':75C 'credenti':104C 'deliv':109C 'direct':79C 'fraudul':110C 'imperson':105C 'messag':80C,96C 'miss':66C 'openemr':61C 'patients/notes':83C 'permiss':84C 'phimail':103C 'recipi':94C 'send':78C 'sent':98C 'submit':92C 'trusted-messages-ajax.php':70C 'user':76C 'via':99C 'vulner':68C 'without':81C 'zero':88C 'zero-acl':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:22:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126447","severity":null,"published_at":"2026-11-13T10:17:52+00:00","modified_at":"2026-11-13T10:17:52+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","fetched_at":"2026-11-13T10:47:23+00:00","note":null}],"documents":[{"id":145138,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:22:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145139,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}