Description
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a patient/QuestionnaireResponse.rs token can request responses by uuid or list the unfiltered bundle to obtain cross-patient clinical assessment answers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.4.0 | 8.4.0 |
References
- GitHub Security Advisory (GHSA-fmmr-p679-97fq) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse third-party-advisory