OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the interface/billing/sl_eob_patient_note.php component. This flaw allows any authenticated user, including those with low privileges, to read and modify patient billing notes by exploiting the patient_id parameter and submitting POST requests with a valid CSRF token. The vulnerability exposes confidential billing data to unauthorized access and tampering.
OpenEMR versions prior to 8.4.0 have a local file inclusion vulnerability in the ESign router component. This flaw allows authenticated attackers to upload a PHP file named Controller.php via the fax module's upload functionality, which does not validate file extensions. The attacker can then exploit the unsanitized module parameter in the ESign router to include and execute this uploaded file, leading to arbitrary code execution.
OpenEMR versions before 8.4.0 have an authorization bypass vulnerability allowing patient-scoped SMART tokens to access other patients' questionnaire responses. This occurs because the FhirQuestionnaireResponseService does not implement the required IPatientCompartmentResourceService, enabling unauthorized read access to clinical assessment data.
OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in portal/lib/persist.php. This flaw allows authenticated portal patients to modify other patients' settings by supplying arbitrary setting_patient values. Exploitation can lead to unauthorized insertion or overwriting of patient_settings entries, potentially suppressing notifications, tampering with consent flags, or altering portal preferences.
OpenEMR versions prior to 8.3.0 have a broken object-level authorization vulnerability in the SOAP note update API. This flaw allows authenticated users with encounters/notes permission to overwrite clinical notes belonging to other patients by manipulating the SOAP note ID in API requests. The vulnerability arises because the API does not verify that the supplied SOAP note ID corresponds to the specified patient and encounter.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the library/ajax/upload.php component. This flaw allows any authenticated user, including low-privilege users, to read and overwrite document data by specifying arbitrary document IDs. Exploitation enables enumeration of document IDs and unauthorized access to patient health information, as well as tampering with medical records across all patients.
OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to access other patients' documents by manipulating request parameters such as Pid_Equals, Pid_GreaterThan, or Pid_In. Exploitation can lead to unauthorized disclosure of sensitive patient information including signed consent forms, signatures, and protected health information (PHI).
OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in multiple encounter-form view and save endpoints. Authenticated clinical users can exploit this flaw by enumerating sequential form IDs in requests to endpoints like soap/view.php and save.php, allowing unauthorized reading and modification of other patients' clinical records.
OpenEMR versions prior to 8.3.0 contain a critical path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method within the oe-module-faxsms. Authenticated attackers can exploit the file_path parameter to read arbitrary files using the action=download option or write web-executable files via action=setup with base64 content, potentially leading to remote code execution. This vulnerability is fixed in OpenEMR 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in portal/portal_payment.php. Low-privilege authenticated users can manipulate patient identifier parameters (pid and form_pid) to bypass billing access controls. This allows unauthorized viewing of payment pages and recording of fraudulent payment receipts for arbitrary patients, potentially corrupting billing records.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability allowing authenticated clinicians without high-sensitivity permissions to read and modify encounter-bound forms. This occurs via load_form.php, enabling access to restricted clinical notes or care plans and tampering with clinical records through save.php. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route. This flaw allows users with limited permissions (demographics and documents) to specify a victim patient parameter and download that patient's full-chart CCDA clinical data without proper authorization. The vulnerability is fixed in version 8.4.0.
OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the classic document controller. This flaw allows low-privilege authenticated users to recategorize documents belonging to other patients. Exploiting this, an attacker can move documents into a patients|demo category and retrieve them with an empty patient_id, enabling unauthorized access to protected health information (PHI) and potential tampering with patient charts.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the patient portal's onsitedocuments API. Authenticated patients can exploit this flaw by manipulating query parameters to access documents belonging to other patients. This bypass allows exposure of sensitive data including consent bodies, signatures, file paths, and template data. The vulnerability is fixed in version 8.3.0.
OpenEMR versions before 8.4.0 have a missing authorization vulnerability in the portal onsite-document APIs. This flaw allows any authenticated core user to access, list, read, and overwrite documents belonging to other patients by omitting the patientId parameter and supplying arbitrary record IDs. The vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 have an incorrect authorization vulnerability in the prescription REST API. The API incorrectly checks the patients.med ACL instead of the more restrictive patients.rx ACL and does not require a specific permission bit. This allows authenticated staff users with read-only Medical/History access to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions across the tenant by reusing the UI-exposed APICSRFTOKEN.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. This flaw enables attackers with only the patients|demo ACL to select and access clinical notes and documents of other patients via patient-scoped FHIR endpoints. The issue is fixed in version 8.4.0.
OpenEMR versions before 8.4.0 have an authorization bypass vulnerability in the Rainforest patient portal payments. The system improperly trusts patient-supplied values for patientId, encounter, and amount instead of using session-derived data. This allows authenticated portal patients to manipulate payment data, causing the payin.authorized webhook to credit other patients' encounters with forged activity credits exceeding the actual amount paid. The issue is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. This is achieved by reusing a session-exposed API CSRF token to bypass FHIR scope checks, enabling unauthorized reading of protected health information (PHI). The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions before 8.4.0 have an arbitrary local file read vulnerability in the REST document download functionality. Authenticated users with document upload and download permissions can exploit this by uploading a document with an absolute file path, then downloading it to read sensitive server files, potentially exposing database credentials. The issue is fixed in version 8.4.0.