The vulnerability allows an authenticated user with low privileges to bypass the required administrator access control when installing or reinstalling a lab compendium. By passing a labGuid to compendium_install.php, the attacker can trigger uninstallation of detail and result procedure types, then deactivate order types before the reinstall step. This results in corruption of the lab‑ordering configuration and loss of specific procedure types, effectively disrupting normal clinical workflows and potentially causing data loss or incorrect ordering behavior. The weakness identified is an authorization flaw.

This issue affects installations of OpenEMR 8.2.x and earlier that have the DORN module enabled. The relevant component is the compendium_install.php script within the oe‑module‑dorn module. The fix is present in OpenEMR version 8.3.0 and above.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score is not available, so the current exploit probability is unclear, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid user account with low privileges that can access the web interface and supply a CSRF token, suggesting the attack vector is internal to an authenticated web session. Once the conditions are met, the attacker can cause destructive changes without further permissions, and the impact is limited to the affected instance of OpenEMR.