Threats tagged 'ghsa-mhv5-qf28-cmp6'

OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to bypass authorization checks by using a capitalized 'Pid' parameter, enabling them to access other patients' onsite documents containing protected health information (PHI).