Threats tagged 'ghsa-hh44-mqpq-84jh'

OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid API route. This flaw allows patient-portal users to access demographic information of staff members by circumventing compartment enforcement. Attackers with a patient SMART token possessing patient/Person.read permission can extract staff Person UUIDs from Appointment references and retrieve sensitive personal data such as names, home addresses, phone numbers, and personal emails.