Threats tagged 'ghsa-mxq4-6pmv-p59f'

OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in multiple encounter-form view and save endpoints. Authenticated clinical users can exploit this flaw by enumerating sequential form IDs in requests to endpoints like soap/view.php and save.php, allowing unauthorized reading and modification of other patients' clinical records.