Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.5.0 | 8.5.0 |
References
- GitHub Security Advisory (GHSA-7cfr-7h7r-f2x9) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php third-party-advisory