Description
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to read any patient's documents and questionnaire responses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.4.0 | 8.4.0 |