PT-2026-146706

CVE-2026-126420

·

Published

2026-11-13

·

Updated

2026-11-13

Description by

CVSS 3.1
5.9
Medium
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-126420
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com