OPENEMR · CVE-2026-126490 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR versions before 8.5.0 contain debug code in the fax viewer that runs a system command and displays the web server's Unix group memberships. An attacker with fax module access can learn groups such as adm or shadow, which helps plan privilege escalation.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running OpenEMR before 8.5.0 where users have access to the fax module. The exposed page is fax_view.php, and the flaw only discloses group names, not data, to logged-in users. Sites on 8.5.0 or later, or with no fax module access for users, are not exposed.
Not affected if no-fax-module-access, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 are affected.passthru("groups") in interface/fax/fax_view.php.8.5.0 or later.OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.