OpenEMR Fax/SMS Module Access Control Bypass (CVE-2026-124450)

CVE-2026-124450 is a broken-access-control and path-traversal flaw in OpenEMR, an open source electronic health record platform. The flaw sits in the bundled fax/sms module, where the disposeDocument action for two fax-vendor clients never checks who is calling it. VulnCheck, the CNA, rates it CVSS 3.1 9.9 Critical.

The module's front controller checks only two things before it runs disposeDocument: that the action name is on an allow list, and that a valid CSRF token is present. Authentication is left to each fax vendor client's own code, and the advisory says two of the three fax vendor clients never run that check.

What CVE-2026-124450 Lets an Attacker Do

Without that check, the only barrier a caller meets is a weaker default permission. The advisory ties that permission to viewing patient demographics, not the stricter document-access permission a fax handler should require. The advisory says most clinical and clerical OpenEMR roles carry that weaker permission.

A user with only that permission can read sqlconf.php, the file that holds OpenEMR's database credentials, and can write files as the web server user, according to the CVE record. The record says this can enable remote code execution where the written file lands somewhere the web server will run it.

The advisory's author says they confirmed both the read and the write against OpenEMR's RingCentral fax client using a non-admin front-office account. The same missing checks exist in OpenEMR's SignalWire client too, which the advisory's author says they found by reviewing the code, not by testing it directly.

CVSS Score and CWE for CVE-2026-124450

VulnCheck scores CVE-2026-124450 as CVSS 3.1 9.9 Critical, with a secondary CVSS 4.0 score of 9.3 Critical. The CVE record lists CWE-73, external control of file name or path, as the primary weakness. See our CVSS entry for how to read the score.

What OpenEMR and CISA KEV Say About Exploitation

OpenEMR's advisory says 8.3.0 is the first fixed release, and every earlier release is affected. As of CISA's Known Exploited Vulnerabilities catalog version 2026.11.06, CVE-2026-124450 is not listed. The advisory and the CVE record do not state whether the flaw has been exploited.

The CVE record and OpenEMR's advisory both list every release before 8.3.0 as affected. OpenEMR 8.3.0 is the first patched release.

OpenEMR's advisory says the fix gives the RingCentral and SignalWire fax clients the same authentication and file-path checks the module's EtherFax client already had. GHSA-wf4w-mx2w-j4vv credits 4nt11 as the reporter.

We recommend planning the version upgrade with our vulnerability management guide. Our remote code execution entry explains why an arbitrary file write matters here.

OpenEMR 8.3.0 also fixes a second, narrower flaw we cover separately in the same module, CVE-2026-124490, which a different researcher reported specifically against the RingCentral client. Sites running the fax/sms module should patch for both.