CVE-2026-126447

OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the...

CVE-2026-126447

OpenEMR versions prior to 8.5.0 are vulnerable to a missing authorization flaw in the trusted-messages-ajax.php component. This allows any authenticated core user to send Direct messages even if they lack the necessary patients/notes permission. Exploiting this, an attacker with a zero-ACL accoun...

EUVD-2026-124988

OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the...