OpenEMR’s document handling code lacked proper authorization checks before reassigning documents to different patients or categories. A legitimate user with only low‑privilege rights could trigger a reassignment operation, thereby attaching a document to a patient or category that the user could access. After reassignment the document could be retrieved through normal read paths, effectively bypassing the system’s intended access controls. The flaw is a classic example of an authority/privilege escalation weakness (CWE‑639) and could lead to confidential medical information being accessed by unauthorized users.

The issue affects the openemr:openemr product in all releases prior to version 8.4.0. Any installation running those earlier releases is susceptible unless remediation has been applied. Version 8.4.0 and later include a fix that validates the caller’s permissions before performing the reassignment.

The vulnerability receives a CVSS score of 9.6, indicating critical severity, and its EPSS score is not available, suggesting no published exploit data yet. It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated web application interaction, where a low‑privilege user must be able to invoke the move_action_process endpoint. Successful exploitation would bypass a later HTTP 403 check, granting excessive access without detection unless logs are closely monitored.