OpenEMR versions before 8.4.0 contain an authorization bypass in the SMART on FHIR interface. The function checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true, allowing any authenticated user or malicious SMART app to bind requests to arbitrary patient UUIDs. This flaw grants unauthorized read and write access to other patients' FHIR resources, exposing sensitive medical information and potentially compromising patient confidentiality and data integrity.

This vulnerability affects the OpenEMR healthcare management system. All releases prior to version 8.4.0 are vulnerable. The affected product is openemr:openemr as listed in the CNA data. No other vendors or products are mentioned in the advisory.

The CVSS score of 6 indicates medium severity. There is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user or a malicious SMART application that can manipulate the token launch context to target arbitrary patients. Because the flaw is remotely triggered via the FHIR API, enterprises using OpenEMR with SMART on FHIR enabled face a risk of PHI exposure and data tampering unless the patch is applied or the feature is restricted.