CVE-2026-126420: OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the formcreate request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with read-only access to patient demographics can exploit it. The attacker must be able to submit the FaxSMS utility.php form_create request.
Are deployments running the fixed release affected?
The issue affects OpenEMR versions before 8.5.0. OpenEMR 8.5.0 is identified as the version boundary in the available information.
What could an attacker create through this flaw?
The attacker can create fictitious or duplicate patient charts using chosen identity fields. The created records can include employer, history, and insurance information.