The vulnerability is an insecure direct object reference in OnsitePortalActivityController::Update() that incorrectly validates the patientId from the request rather than the record owner. Authenticated portal patients can send PUT requests with another patient’s activity ID and their own patientId, enabling disclosure of sensitive internal data such as tableArgs and checksum. Attackers can also overwrite narratives and status fields, effectively taking ownership of the record.

OpenEMR versions prior to 8.3.0, the open‑source electronic medical record system. Any installation that exposes the OnsitePortalActivityController Update API to portal users is vulnerable. The flaw impacts the portal activity API endpoint used by authenticated patients.

The CVSS score of 8.6 signals high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated network request; a malicious portal user must know or discover another patient’s activity ID to exploit it. Once compromised, an attacker can modify, hide, and take ownership of another patient’s record, posing a serious confidentiality and integrity risk.