OpenEMR's optional FaxSMS module contains an authorization bypass in the AppDispatch constructor. The constructor accepts actions supplied by an authenticated user and exits before any calling code can enforce ACL checks. Consequently, methods such as getNotificationLog() can be invoked by any authenticated user, exposing patient appointment data that is considered PHI. The flaw lies entirely in the lack of permission verification, allowing unauthorized disclosure of confidential health information.

All installations of OpenEMR running versions prior to 8.0.0.2, including those that include the FaxSMS optional module, are affected. The issue is limited to the FaxSMS module and does not impact the core OpenEMR functionality. Versions 8.0.0.2 and later contain the necessary fix.

The vulnerability has a CVSS score of 5.4, classifying it as a medium severity issue. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Attack requires the attacker to be an authenticated user within the OpenEMR system; no remote code execution or privilege escalation is possible. Because the flaw allows the retrieval of PHI without proper authorization, the potential impact on confidentiality is significant for affected users.