Threats tagged 'ghsa-675r-3fhw-4gq7'

OpenEMR versions prior to 8.3.0 have a broken object-level authorization vulnerability in the SOAP note update API. This flaw allows authenticated users with encounters/notes permission to overwrite clinical notes belonging to other patients by manipulating the SOAP note ID in API requests. The vulnerability arises because the API does not verify that the supplied SOAP note ID corresponds to the specified patient and encounter.