PT-2026-26347 · Openemr · Openemr+1

Pavelkohout396 + 1 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33305

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authorization bypass in the optional FaxSMS module (oe-module-faxsms) allows authenticated users to invoke controller methods, including getNotificationLog(), without proper access control checks. The AppDispatch constructor bypasses ACL enforcement, potentially exposing patient appointment data (PHI).

Recommendations Update to OpenEMR version 8.0.0.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-696

Related Identifiers

BDU:2026-05093

CVE-2026-33305

GHSA-R973-H5CQ-35RC

Affected Products

Faxsms Module

Openemr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33305.json · Exploit
• https://github.com/openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33305 · Security Note
• https://bdu.fstec.ru/vul/2026-05093 · Security Note
• https://twitter.com/infoflowcloud/status/2035994049367122412 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034772455600873827 · Twitter Post
• https://twitter.com/CVEnew/status/2035992546732613938 · Twitter Post