# CVE-2026-33305

## Summary

- **CVE ID:** CVE-2026-33305
- **Severity:** MEDIUM
- **CVSS Score:** 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **CWE:** CWE-696, CWE-862
- **Published:** Mar 19, 2026
- **Last Modified:** Mar 21, 2026

## Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.

## Affected Products

- openemr — openemr (< 8.0.0.2)

## References

- [CNA](https://github.com/openemr/openemr/security/advisories/GHSA-r973-h5cq-35rc)
- [CNA](https://github.com/openemr/openemr/commit/edb65936e259b2625e8eea4628316c4577cb2a11)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.21%
- **EPSS Percentile:** 11.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._