Improper access control in OpenEMR - #VU158837
Published: November 3, 2026
Vulnerability identifier: #VU158837
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create unauthorized patient charts and associated records, compromising the integrity of clinical and billing workflows.
The vulnerability exists due to improper access control in the OpenEMR FaxSMS utility when processing patient-creation form submissions. A remote user can submit a request with a valid CSRF token using read-only demographics access to create fictitious or duplicate patient charts and associated employer, history, and insurance records without the required write or add-only permission.
Exploitation requires FaxSMS to be enabled and a fax provider to be configured.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0