OpenEMR before 8.3.0 includes an insecure direct object reference flaw in portal/lib/persist.php that lets an authenticated portal patient modify the setting_patient field in a JSON POST request. This change can reference another patient’s ID and alter that patient’s portal settings, such as the theme, without permission. The vulnerability is a classic IDOR (CWE-639) that allows an attacker to tamper with data belonging to other users, potentially undermining the confidentiality of patient preferences and the integrity of the application’s state.

The vendor is OpenEMR and the affected product is OpenEMR. All installations of OpenEMR prior to version 8.3.0 are vulnerable. No specific patchlevel is listed beyond the 8.3.0 boundary, so any release earlier than 8.3.0 is at risk.

The CVSS score of 7.1 signals a high impact attack vector when the attacker already has an authenticated portal session. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the flaw is not listed in the CISA KEV catalog. The attack most likely occurs via a benign-looking POST request from a victim’s own portal session, meaning users with legitimate accounts can inadvertently facilitate exploitation. Due to the nature of the IDOR, once the attacker manipulates the setting_patient parameter, they can change any other patient’s settings without further interaction, making the modification permanent unless reversed.