Threats tagged 'ghsa-jhmg-9h4m-r2f5'

OpenEMR versions prior to 8.4.0 contain an authorization bypass vulnerability that allows low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. This flaw enables attackers with only the patients|demo ACL to select a victim during authorization and access that patient's clinical notes and documents via patient-scoped FHIR endpoints.