OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in the OnsitePortalActivityController::Update() function. This flaw allows authenticated portal patients to manipulate PUT requests by specifying another patient's activity ID along with their own patientId, enabling unauthorized disclosure and modification of patient activity records.