PT-2026-26347 · Openemr · Openemr+1

Pavelkohout396 + 1 · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-33305

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authorization bypass in the optional FaxSMS module (oe-module-faxsms) allows authenticated users to invoke controller methods, including getNotificationLog(), without proper access control checks. The AppDispatch constructor bypasses ACL enforcement, potentially exposing patient appointment data (PHI).

Recommendations Update to OpenEMR version 8.0.0.2 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-696

Identificadores relacionados

BDU:2026-05093

CVE-2026-33305

GHSA-R973-H5CQ-35RC

Produtos afetados

Faxsms Module

Openemr

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33305.json · Exploit
• https://github.com/openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11 · Correção
• https://github.com/openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33305 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2035994049367122412 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034772455600873827 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035992546732613938 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33305 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-05093 · Nota de Segurança