The vulnerability arises from missing authorization checks on several download endpoints (custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php) in OpenEMR versions prior to 8.3.0. While these endpoints validate CSRF tokens, they do not enforce the patient or medical record access control list that governs the official CQM report page. As a result, a low‑privilege authenticated user can supply an unscoped report_id and trigger QRDA Category 1 and Category 3 report generation and download logic for other patients, exposing confidential clinical documents.

The issue affects installations of OpenEMR older than version 8.3.0. It applies to the specified download and export endpoints and any clinic that has generated CQM reports. The CVE references a commit and a pull request that introduced the fix in the 8.3.0 release.

OpenEMR assigns this flaw a CVSS score of 6.5, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed as a Known Exploited Vulnerability. The likely attack vector requires that an attacker be able to authenticate to the system, but can hold only limited privileges. Once authenticated, the attacker can request report files for any patient by manipulating the report_id parameter, gaining access to protected health information. The fix eliminates the missing authorization check and restricts endpoints to the correct ACL.