Threats tagged 'ghsa-rq9x-wq7p-vvvq'

OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability that allows low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. This is achieved by sending the APICSRFTOKEN header and reusing the session-exposed api_csrf_token_js value to bypass FHIR scope checks. Exploitation enables unauthorized reading of sensitive patient questionnaire answers containing protected health information (PHI).