OpenEMR versions prior to 8.4.0 have a missing authorization vulnerability affecting the FHIR Media/:uuid and QuestionnaireResponse read routes. This flaw allows non-patient API tokens without OpenEMR ACLs to bypass access control checks and retrieve any patient's documents and questionnaire responses by UUID.