SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability in the ModalAnchorEditor's #createBookmarkList function. This flaw arises because entity-decoded header text (h1-h6) is inserted into the bookmark list using innerHTML without proper escaping. An attacker can store malicious HTML-encoded payloads in editor headers that execute JavaScript when a user opens the link modal and types # in the URL input. The vulnerability is fixed in version 3.4.0.
SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability in the FileUpload plugin's create() method. This flaw occurs because server-returned file names are assigned to innerHTML without proper escaping, allowing attackers to upload files with malicious HTML content. When such content or gallery items are loaded, the embedded JavaScript executes in victims' browsers, potentially leading to session theft. The vulnerability is fixed in version 3.4.0.
OpenEMR versions prior to 8.3.0 contain a critical path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method within the oe-module-faxsms. Authenticated attackers can exploit the file_path parameter to read arbitrary files using the action=download option or write web-executable files via action=setup with base64 content, potentially leading to remote code execution. This vulnerability is fixed in OpenEMR 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in portal/portal_payment.php. Low-privilege authenticated users can manipulate patient identifier parameters (pid and form_pid) to bypass billing access controls. This allows unauthorized viewing of payment pages and recording of fraudulent payment receipts for arbitrary patients, potentially corrupting billing records.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability allowing authenticated clinicians without high-sensitivity permissions to read and modify encounter-bound forms. This occurs via load_form.php, enabling access to restricted clinical notes or care plans and tampering with clinical records through save.php. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route. This flaw allows users with limited permissions (demographics and documents) to specify a victim patient parameter and download that patient's full-chart CCDA clinical data without proper authorization. The vulnerability is fixed in version 8.4.0.
OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the classic document controller. This flaw allows low-privilege authenticated users to recategorize documents belonging to other patients. Exploiting this, an attacker can move documents into a patients|demo category and retrieve them with an empty patient_id, enabling unauthorized access to protected health information (PHI) and potential tampering with patient charts.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the patient portal's onsitedocuments API. Authenticated patients can exploit this flaw by manipulating query parameters to access documents belonging to other patients. This bypass allows exposure of sensitive data including consent bodies, signatures, file paths, and template data. The vulnerability is fixed in version 8.3.0.
OpenEMR versions before 8.4.0 have a missing authorization vulnerability in the portal onsite-document APIs. This flaw allows any authenticated core user to access, list, read, and overwrite documents belonging to other patients by omitting the patientId parameter and supplying arbitrary record IDs. The vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 have an incorrect authorization vulnerability in the prescription REST API. The API incorrectly checks the patients.med ACL instead of the more restrictive patients.rx ACL and does not require a specific permission bit. This allows authenticated staff users with read-only Medical/History access to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions across the tenant by reusing the UI-exposed APICSRFTOKEN.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. This flaw enables attackers with only the patients|demo ACL to select and access clinical notes and documents of other patients via patient-scoped FHIR endpoints. The issue is fixed in version 8.4.0.
OpenEMR versions before 8.4.0 have an authorization bypass vulnerability in the Rainforest patient portal payments. The system improperly trusts patient-supplied values for patientId, encounter, and amount instead of using session-derived data. This allows authenticated portal patients to manipulate payment data, causing the payin.authorized webhook to credit other patients' encounters with forged activity credits exceeding the actual amount paid. The issue is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. This is achieved by reusing a session-exposed API CSRF token to bypass FHIR scope checks, enabling unauthorized reading of protected health information (PHI). The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions before 8.4.0 have an arbitrary local file read vulnerability in the REST document download functionality. Authenticated users with document upload and download permissions can exploit this by uploading a document with an absolute file path, then downloading it to read sensitive server files, potentially exposing database credentials. The issue is fixed in version 8.4.0.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php. This flaw allows low-privileged authenticated users to modify recall data of arbitrary patients by submitting crafted parameters, potentially overwriting sensitive patient records. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability that permits low-privileged authenticated users to delete arbitrary patient recall records. This occurs via the delete_Recall action by sending crafted POST requests to /interface/main/messages/save.php with specific patient and recall IDs, bypassing access control checks.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in portal/lib/paylib.php. The application fails to verify that the patient ID submitted in payment-related requests matches the authenticated session patient. This allows authenticated portal patients to insert or modify payment audit records of other patients, potentially compromising billing data integrity.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in portal/lib/persist.php. Authenticated portal patients can manipulate the setting_patient parameter to modify other patients' settings, including suppressing notifications, altering consent flags, or changing portal preferences. This vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 have a broken object-level authorization vulnerability in the SOAP note update API. Authenticated users with encounters/notes permission can overwrite clinical notes belonging to other patients by supplying a SOAP note ID (sid) that does not belong to the specified patient and encounter. This allows unauthorized modification and reassignment of clinical notes.
OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the billing notes interface that allows any authenticated user, including those with low privileges, to read and modify patient billing notes. This occurs due to insufficient access controls on the patient_id parameter and the ability to submit POST requests with a valid CSRF token. The vulnerability is fixed in version 8.3.0.