CVE-2026-126490
LOW
NVD
CVSS Score
3.1
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.