Threats tagged 'ghsa-g8pc-cv83-gmcj'

OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref endpoint. This flaw allows users with limited permissions (demographics and documents) to specify a victim patient parameter and download that patient's full clinical document architecture (CCDA), potentially exposing sensitive clinical data.