Threats tagged 'ghsa-mm3c-hq5r-q7pg'

OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in the patient portal onsitedocuments API. This flaw allows authenticated patients to access documents belonging to other patients by manipulating query parameters to bypass patient scoping and locked filters. Sensitive information such as consent bodies, signatures, file paths, and template data may be exposed. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact.