OpenEMR versions prior to 8.3.0 have a critical path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method within the oe-module-faxsms. Authenticated attackers can exploit the file_path parameter to read and write arbitrary files. Using the action=download parameter, attackers can read sensitive files such as credentials and source code. Using action=setup with base64-encoded content, attackers can write web-executable files, enabling remote code execution.
OpenEMR versions before 8.4.0 have an authorization vulnerability in the prescription REST API routes. The API incorrectly checks the patients.med ACL instead of patients.rx and does not require a specific permission bit, allowing read-only Medical/History access to pass. Authenticated staff users can exploit this by reusing the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, create forged prescriptions for any patient, and deactivate prescriptions across the tenant.
OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability that allows low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. This is achieved by sending the APICSRFTOKEN header and reusing the session-exposed api_csrf_token_js value to bypass FHIR scope checks. Exploitation enables unauthorized reading of sensitive patient questionnaire answers containing protected health information (PHI).
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the Rainforest patient portal payments. The vulnerability arises because the system trusts browser-supplied patientId, encounter, and amount values instead of deriving them securely from the portal session. Authenticated patients can manipulate JSON data sent to portal_payment.rainforest.php, causing the payin.authorized webhook to write forged activity credits to other patients' encounters, potentially exceeding the actual payment amount.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability that permits low-privileged authenticated users to delete arbitrary patient recall records. This is achieved by sending crafted POST requests to the /interface/main/messages/save.php endpoint with specific parameters, bypassing access control checks.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in the patient portal onsitedocuments API. This flaw allows authenticated patients to access documents belonging to other patients by manipulating query parameters to bypass patient scoping and locked filters. Sensitive information such as consent bodies, signatures, file paths, and template data may be exposed. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact.
OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. This flaw enables attackers with only the patients|demo ACL to select a victim during authorization and access that patient's clinical notes and documents via patient-scoped FHIR endpoints.
OpenEMR versions prior to 8.4.0 have an arbitrary local file read vulnerability in the REST document download functionality. Authenticated users with document upload and download permissions can exploit this by uploading a document with an absolute file path, then downloading it to read sensitive server files such as database configuration files. This vulnerability allows unauthorized disclosure of sensitive information without impacting system integrity or availability.
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref endpoint. This flaw allows users with limited permissions (demographics and documents) to specify a victim patient parameter and download that patient's full clinical document architecture (CCDA), potentially exposing sensitive clinical data.
OpenEMR versions prior to 8.4.0 have a missing authorization vulnerability in the portal onsite-document APIs. This flaw allows any authenticated core user to access, list, read, and overwrite documents belonging to other patients by omitting the patientId parameter and supplying arbitrary record IDs. The vulnerability affects patient portal documents, signatures, and template data.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the classic document controller. This flaw allows low-privilege authenticated users to recategorize documents belonging to other patients. By exploiting the move_action_process function, attackers can move documents into a patients|demo category and then retrieve them without specifying a patient ID, enabling exfiltration of protected health information (PHI) and unauthorized modification of patient charts.
OpenEMR versions prior to 8.3.0 have a broken access control vulnerability in portal/portal_payment.php. This flaw allows authenticated users with low privileges to bypass billing access control checks by manipulating patient identifier parameters. Exploitation enables viewing payment pages and recording fraudulent payment receipts for arbitrary patients, leading to corrupted billing records.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php. This flaw allows low-privileged authenticated users to modify recall data of arbitrary patients by submitting crafted parameters, potentially overwriting patient records they should not access.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability that allows authenticated clinicians without high-sensitivity permissions to read and modify encounter-bound forms. The vulnerability involves exploiting load_form.php to access restricted clinical notes or care plans and obtain a CSRF token, which can then be used with save.php to alter clinical records.
OpenEMR versions prior to 8.3.0 have an SQL injection vulnerability in the Standard REST API endpoints for patient insurance and employer search. This flaw allows authenticated users, including those with low-privilege patient-portal OAuth2 tokens, to craft parameter names that are concatenated into SQL queries without proper escaping. Exploitation can lead to unauthorized extraction of patient protected health information (PHI), user records, and API client secrets.
OpenEMR versions prior to 8.4.0 have a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to register an OAuth2 client with an unvalidated jwks_uri, enabling the server to send arbitrary HTTP requests. Attackers can exploit this via the token introspection endpoint using an unsigned client_assertion to probe internal services and access cloud metadata endpoints.
OpenEMR versions prior to 8.3.0 have a broken object level authorization vulnerability in the portal_custom_report.php component. This flaw allows authenticated portal patients to access other patients' sensitive medical information by enumerating sequential IDs in the issue_ parameter. The exposed data includes problem titles, clinical notes, ICD diagnosis codes, and contraceptive records.
OpenEMR versions prior to 8.3.0 contain a critical SQL injection vulnerability in the Fee Sheet drug-inventory lookup functionality. This flaw allows low-privileged authenticated users to inject SQL code via the prod[N][warehouse] POST parameter, enabling time-based blind SQL injection attacks. Exploitation can lead to unauthorized extraction of sensitive patient data and bcrypt password hashes from the users_secure table.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the billing interface (sl_eob_invoice.php) that allows any authenticated user to read and modify billing data for any patient encounter. This includes reading patient names and billing notes and posting payments, adjustments, deletions, or billing notes to any patient's account.
OpenEMR versions prior to 8.3.0 have an insecure direct object reference vulnerability in portal/lib/paylib.php. This flaw allows authenticated portal patients to manipulate payment audit records of other patients by submitting crafted requests that alter billing records without proper session validation.