OpenEMR versions prior to 8.4.0 allow an attacker to use a non-patient API token to access FHIR Media and QuestionnaireResponse resources by UUID, bypassing the intended access control. The vulnerability results in the disclosure of private patient documents and questionnaire responses, compromising confidentiality and potentially privacy of patient data.

The issue affects OpenEMR, any installation using a version older than 8.4.0. Users of the openemr:openemr product who have deployed the affected releases are at risk. Versions 8.4.0 and newer include the proper access control logic and are not vulnerable.

With a CVSS score of 7.1, the vulnerability is a high severity risk. Attackers can exploit it by sending authenticated API requests with any generated token lacking OpenEMR ACLs; the exploit requires network access to the OpenEMR FHIR endpoint. The EPSS score is not available, and the vulnerability is not currently featured in the CISA KEV catalogue, but the absence of ACL checks in public-facing API routes makes it a viable target for attackers who can obtain any usable API token.