CVE-2026-33305: OpenEMR FaxSMS Auth Bypass Vulnerability

CVE-2026-33305 Overview

OpenEMR is a free and open source electronic health records (EHR) and medical practice management application widely used in healthcare environments. An authorization bypass vulnerability exists in the optional FaxSMS module (oe-module-faxsms) that allows any authenticated OpenEMR user to invoke controller methods—including getNotificationLog(), which returns patient appointment data containing Protected Health Information (PHI)—regardless of whether they hold the required ACL permissions.

The vulnerability stems from the AppDispatch constructor, which dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. This architectural flaw enables unauthorized access to sensitive patient data, posing significant privacy and regulatory compliance risks for healthcare organizations.

Critical Impact

Any authenticated OpenEMR user can bypass access control mechanisms to retrieve sensitive patient appointment data (PHI), potentially violating HIPAA compliance and exposing healthcare organizations to regulatory penalties.

Affected Products

• OpenEMR versions prior to 8.0.0.2
• OpenEMR installations with the optional oe-module-faxsms module enabled

Discovery Timeline

• 2026-03-19 - CVE-2026-33305 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33305

Vulnerability Analysis

This authorization bypass vulnerability affects the FaxSMS module's controller dispatch mechanism in OpenEMR. The root cause is classified under CWE-696 (Incorrect Behavior Order), indicating that security checks occur in the wrong sequence during request processing.

When a user makes a request to the FaxSMS module, the AppDispatch constructor processes user-controlled action parameters and executes the corresponding controller methods before the application's access control layer has an opportunity to validate user permissions. This premature execution allows any authenticated user—even those with minimal privileges—to invoke sensitive functions like getNotificationLog() that should be restricted to authorized personnel.

The exposure of patient appointment data through this vulnerability represents a serious breach of healthcare data confidentiality, as PHI includes identifiable patient information protected under regulations such as HIPAA.

Root Cause

The vulnerability originates from a design flaw in the AppDispatch class within interface/modules/custom_modules/oe-module-faxsms/src/Controller/AppDispatch.php. The constructor dispatches actions based on user input and terminates execution before ACL validation can be performed by the calling code. This incorrect ordering of operations means the access control checks that should protect sensitive endpoints are never executed.

Attack Vector

An attacker must first authenticate to the OpenEMR system with any valid user account. Once authenticated, they can craft requests to the FaxSMS module specifying controller methods as action parameters. Because the dispatch logic executes before ACL enforcement, the attacker can invoke privileged functions and retrieve sensitive data without proper authorization.

The attack requires network access and valid credentials but does not require any special permissions or user interaction, making it relatively straightforward to exploit in environments where the FaxSMS module is deployed.

 namespace OpenEMR\Modules\FaxSMS\Controller;
 
 use MyMailer;
+use OpenEMR\Common\Acl\AccessDeniedHelper;
 use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Crypto\CryptoGen;
 use OpenEMR\Common\Session\SessionUtil;

Source: GitHub Commit Details

The security patch introduces the AccessDeniedHelper class into the dispatch logic, ensuring that ACL checks are properly enforced before controller methods are executed.

Detection Methods for CVE-2026-33305

Indicators of Compromise

• Unusual access patterns to the FaxSMS module (oe-module-faxsms) endpoints from low-privileged user accounts
• Multiple requests to getNotificationLog() or similar controller methods from users who do not have administrative or clinical roles
• Access log entries showing FaxSMS module requests from user accounts that should not have access to patient data

Detection Strategies

• Review OpenEMR access logs for requests to /interface/modules/custom_modules/oe-module-faxsms/ endpoints
• Implement monitoring for users accessing FaxSMS module functions without corresponding ACL permissions
• Audit user accounts that have accessed patient notification logs and verify authorization

Monitoring Recommendations

• Enable detailed logging for all FaxSMS module controller invocations
• Set up alerts for access to PHI-containing endpoints by non-clinical users
• Implement user behavior analytics to detect privilege abuse patterns in healthcare applications

How to Mitigate CVE-2026-33305

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.2 or later immediately
• If immediate upgrade is not possible, disable the oe-module-faxsms module until the patch can be applied
• Audit access logs for any signs of exploitation prior to patching
• Review user accounts that accessed the FaxSMS module and verify appropriate authorization

Patch Information

OpenEMR has released version 8.0.0.2 which addresses this authorization bypass vulnerability. The fix modifies the AppDispatch class to properly enforce ACL checks before executing controller methods. Organizations should upgrade by applying the patch from the GitHub commit or updating to the latest release.

For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory.

Workarounds

• Disable the FaxSMS module (oe-module-faxsms) if it is not essential to operations
• Restrict network access to the OpenEMR installation to trusted IP ranges
• Implement additional authentication layers or web application firewall rules to limit access to the FaxSMS module endpoints

# Disable FaxSMS module in OpenEMR
# Navigate to Administration -> Modules and disable oe-module-faxsms
# Alternatively, remove module directory (backup first):
mv /var/www/html/openemr/interface/modules/custom_modules/oe-module-faxsms /var/www/html/openemr/interface/modules/custom_modules/oe-module-faxsms.disabled