Description
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.3.0 | 8.3.0 |
References
- GitHub Security Advisory (GHSA-j347-wp33-79q9) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php third-party-advisory