CVE-2026-126447: OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging
OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR core user, including an account with zero ACL permissions, can exploit it. The attacker does not need the patients/notes permission that should control this messaging capability.
What does an attacker need to send fraudulent messages?
The attacker needs a valid authenticated core-user account and the ability to submit chosen recipients and message bodies to the affected endpoint. No user interaction is required.
What is the impact of successful exploitation?
An attacker can send Direct messages through the clinic's phiMail credentials, making messages appear to originate from the clinic. This can be used to impersonate the clinic in fraudulent clinical communications.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. Upgrading to 8.5.0 or later addresses the affected version range described.