Threats tagged 'ghsa-3v64-jh34-wvm3'

OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php. This flaw allows low-privileged authenticated users to modify recall data of arbitrary patients by submitting crafted parameters, potentially overwriting patient records they should not access.