OpenEMR versions prior to 8.3.0 have a broken object level authorization vulnerability in the portal_custom_report.php component. This flaw allows authenticated portal patients to access other patients' sensitive medical information by enumerating sequential IDs in the issue_ parameter. The exposed data includes problem titles, clinical notes, ICD diagnosis codes, and contraceptive records.