CVE-2026-126420

EUVD-2026-125023
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 26.32%
Common Weakness Enumeration
References
https://github.com/openemr/openemr/security/advisories/GHSA-ppg9-2f9f-chc4
https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-faxsms-utility-php-patient-creation
https://github.com/openemr/openemr/security/advisories/GHSA-ppg9-2f9f-chc4