Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.4.0 | 8.4.0 |
References
- GitHub Security Advisory (GHSA-r79c-4hf6-fgp3) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref third-party-advisory