Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-126490— OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php

Quick assessment

Affected

openemr openemr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenEMR 8.5.0 之前版本在文件中存在活跃的调试代码，该代码会执行命令，从而泄露 Web 服务器的 Unix 用户组信息。拥有传真模块访问权限的已认证攻击者可以通过提供一个不存在的值来触发此行为，进而揭示诸如或等敏感用户组信息，为权限提升攻击提供规划依据。

CVSS 3.1 · Low EPSS 0.26% · P18 Updated Nov 15, 2026

Possible ATT&CK Techniques 2 AI

T1005 · Data from Local System T1082 · System Information Discovery

Affected Version Matrix 2

Vendor	Product	Version Range	Status
openemr	openemr	`< 8.5.0`	affected
		`8.5.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php

Source: CVE Program / CVE List V5

Vulnerability Description

OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
openemr	openemr	0 ~ 8.5.0	-

II. Public POCs for CVE-2026-126490

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126490

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-126490 (2)

Active Debug Code in fax_view.php Discloses Web Server Group Membership · Advisory · openemr/openemr · GitHub vendor-advisory
OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126490

Same Patch Batch · openemr · 2026-11-13 · 80 CVEs total

CVE-2026-126473	9.1 CRITICAL	OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization
CVE-2026-126458	8.8 HIGH	OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php
CVE-2026-126482	8.8 HIGH	OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload
CVE-2026-126487	8.8 HIGH	OpenEMR before 8.5.0 Global Configuration Override via user_settings.php
CVE-2026-126468	8.8 HIGH	OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints
CVE-2026-126466	8.8 HIGH	OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints
CVE-2026-126469	8.8 HIGH	OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts
CVE-2026-126472	8.8 HIGH	OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosur
CVE-2026-126470	8.8 HIGH	OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions
CVE-2026-126442	8.1 HIGH	OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover
CVE-2026-126455	8.1 HIGH	OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection
CVE-2026-126454	8.1 HIGH	OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2
CVE-2026-126322	8.1 HIGH	OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php
CVE-2026-126481	8.1 HIGH	OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload
CVE-2026-126434	8.1 HIGH	OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form
CVE-2026-126480	8.1 HIGH	OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names
CVE-2026-126430	8.1 HIGH	OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names
CVE-2026-126488	7.7 HIGH	OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd
CVE-2026-126479	7.6 HIGH	OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions
CVE-2026-126491	7.6 HIGH	OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php

Showing top 20 of 80 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: openemr

Same vendor: openemr

Same weakness: CWE-200