CVE-2026-126447
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in OpenEMR Allows Fraudulent Message Delivery

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126447
EUVD
EUVD-2026-124988

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has a missing authorization flaw in trusted-messages-ajax.php. This allows any authenticated core user, even those with minimal permissions, to send Direct messages without needing the patients/notes permission. Attackers with zero-ACL accounts can manipulate recipients and message content, using the clinic's phiMail credentials to send fraudulent clinical communications while impersonating the clinic.

Detection Guidance

Check OpenEMR logs for unusual Direct message activity, especially from zero-ACL accounts. Look for messages sent via phiMail credentials without proper patient/notes permissions. Review trusted-messages-ajax.php access logs for unauthorized POST requests.

Impact Analysis

This vulnerability allows attackers to send fake clinical messages that appear to come from your clinic. Patients or recipients may receive misleading or fraudulent communications, potentially leading to misinformation, compromised trust, or unauthorized actions based on false medical advice. Clinics could face reputational damage or legal consequences if fraudulent messages cause harm.

Compliance Impact

This vulnerability likely violates regulations like HIPAA and GDPR by enabling unauthorized access to protected health information (PHI) and allowing fraudulent communications that could compromise patient data integrity and confidentiality. Clinics may face fines or penalties for failing to protect PHI and ensure secure messaging.

Mitigation Strategies
  • Upgrade OpenEMR to version 8.5.0 or later to patch the missing authorization flaw.
  • Audit user permissions and remove zero-ACL accounts or restrict their access to Direct messaging.
  • Monitor phiMail credentials for unauthorized use and rotate them if compromised.
  • Implement stricter access controls for trusted-messages-ajax.php to enforce patient/notes permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...