Threats tagged 'ghsa-85p4-grr3-gp5m'

OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability in the SMART on FHIR implementation. The function checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php incorrectly always returns true, allowing authenticated users or malicious SMART apps to manipulate token launch context. This enables unauthorized read and write access to other patients' FHIR resources.