CVE-2026-33305: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33305 is an authorization bypass vulnerability in the optional FaxSMS module (oe-module-faxsms) of OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application. The flaw allows any authenticated OpenEMR user to invoke protected controller methods — including getNotificationLog(), which returns patient appointment data (PHI) — without holding the required ACL permissions. It affects all OpenEMR versions up to and including 8.0.0.1, and was disclosed on March 19, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is an incorrect behavior order (CWE-696) combined with missing authorization (CWE-862) in the AppDispatch class located at interface/modules/custom_modules/oe-module-faxsms/src/Controller/AppDispatch.php. The AppDispatch constructor calls dispatchActions(), which reads the user-controlled _ACTION_COMMAND query parameter and invokes the corresponding method via method_exists() with no allowlist, then calls render() which echoes the response and calls exit() — all before any ACL check in the calling file can execute. Every FaxSMS entry point (messageUI.php, contact.php, setup.php, index.php) instantiates a service client that triggers this constructor, and index.php (the target of the .htaccess URL rewrite for AJAX routing) has no verifyAcl() call at all. Two methods are directly exploitable: getNotificationLog() (exposes PHI from the notification_log table) and saveSetup() (overwrites module API credentials from $_REQUEST) (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated OpenEMR user — even one explicitly denied the patients:demo ACL — to read patient appointment notification data (PHI) including patient IDs, appointment timestamps, patient names, and notification message text from the notification_log table. Additionally, an attacker can invoke saveSetup() to overwrite module API credentials (e.g., Twilio SMS keys) with attacker-controlled values, potentially enabling further abuse of the communications infrastructure. In healthcare environments where insider threats and shared credentials are common concerns, this represents a significant HIPAA-relevant data exposure risk, though the attack surface is limited to installations where the optional FaxSMS module is enabled and configured (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of concrete HTTP GET requests with specific parameters that directly demonstrate unauthorized PHI retrieval. The exploit requires only a valid authenticated session (low-privilege user) and network access to the OpenEMR instance. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.021% (very low probability of exploitation in the near term) (GitHub Advisory).

1. Reconnaissance: Identify OpenEMR instances running versions ≤ 8.0.0.1 with the FaxSMS module enabled. This can be done by checking for the presence of /interface/modules/custom_modules/oe-module-faxsms/ paths or by reviewing publicly exposed OpenEMR installations.
2. Authenticate: Log in to the OpenEMR instance with any valid user account, even one with minimal privileges (e.g., a billing clerk or receptionist account without patients:demo ACL).
3. Confirm ACL block on normal path: Navigate to messageUI.php?type=sms (without _ACTION_COMMAND) to confirm the UI displays "Not Authorised!" — verifying the target user lacks the required ACL.
4. Bypass ACL via direct request: Send a crafted GET request using the authenticated session cookie to invoke getNotificationLog() directly:

   GET /interface/modules/custom_modules/oe-module-faxsms/messageUI.php?type=sms&_ACTION_COMMAND=getNotificationLog&datefrom=2024-01-01&dateto=2025-12-31

5. Alternative path via index.php rewrite: The same bypass works through the .htaccess rewrite path:

   GET /interface/modules/custom_modules/oe-module-faxsms/getNotificationLog?type=sms&datefrom=2024-01-01&dateto=2025-12-31

6. Exfiltrate PHI: Observe the HTML response containing table rows from notification_log with patient IDs, appointment dates, patient names, and message content.
7. Overwrite credentials (optional): Invoke saveSetup via _ACTION_COMMAND=saveSetup with attacker-controlled credential values in $_REQUEST to overwrite module API credentials (e.g., Twilio keys) (GitHub Advisory).

• Network: Unusual HTTP GET requests to /interface/modules/custom_modules/oe-module-faxsms/messageUI.php or /interface/modules/custom_modules/oe-module-faxsms/index.php containing the _ACTION_COMMAND query parameter from users who do not normally access the FaxSMS module.
• Network: Requests to the .htaccess rewrite path /interface/modules/custom_modules/oe-module-faxsms/getNotificationLog with datefrom/dateto parameters.
• Logs: OpenEMR web server access logs showing _ACTION_COMMAND=getNotificationLog or _ACTION_COMMAND=saveSetup parameters in requests from low-privilege user sessions.
• Logs: Repeated access to FaxSMS module endpoints by user accounts that have no legitimate business need for the module (e.g., billing or administrative accounts).
• Application: Unexpected changes to FaxSMS module API credentials in the module_faxsms_credentials table, which may indicate saveSetup() was invoked by an unauthorized user (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which fixes the issue by adding a verifyAcl() check inside the AppDispatch constructor before dispatchActions() is called, using AccessDeniedHelper to return a 403 Forbidden response for unauthorized requests. If immediate patching is not possible, disable the optional FaxSMS module (oe-module-faxsms) until the patch can be applied. Additionally, restrict network access to OpenEMR to trusted users and networks, and review access logs for unauthorized calls to FaxSMS module endpoints, particularly those containing _ACTION_COMMAND=getNotificationLog or _ACTION_COMMAND=saveSetup (GitHub Advisory, Patch Commit).

The vulnerability was discovered and reported by researchers Pavel Kohout, Petr Simecek, Stanislav Fort, and the Aisle Research team (www.aisle.com), who published a blog post noting the discovery of 38 critical security vulnerabilities in healthcare software used by 100,000 providers. The advisory was published by OpenEMR maintainer kojiromike on March 19, 2026, with a patch released the same day. No significant broader media coverage or social media discussion beyond automated CVE tracking feeds has been observed (GitHub Advisory).