Threats tagged 'ghsa-3754-2xg9-wmj5'

OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability that allows authenticated clinicians without high-sensitivity permissions to read and modify encounter-bound forms. The vulnerability involves exploiting load_form.php to access restricted clinical notes or care plans and obtain a CSRF token, which can then be used with save.php to alter clinical records.