Threats tagged 'ghsa-p35m-f2m7-78qg'

OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability that permits low-privileged authenticated users to delete arbitrary patient recall records. This is achieved by sending crafted POST requests to the /interface/main/messages/save.php endpoint with specific parameters, bypassing access control checks.