CVE-2026-33305

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authorization bypass in the optional FaxSMS module (oe-module-faxsms) allows authenticated users to invoke controller methods, including getNotificationLog(), without proper access control checks. The AppDispatch constructor bypasses ACL enforcement, potentially exposing patient appointment data (PHI).

Recommendations Update to OpenEMR version 8.0.0.2 or later.