OpenEMR before 8.3.0 contains an insecure direct object reference in the OnsiteDocument API. Authenticated portal patients can override the Pid_Equals, Pid_GreaterThan, or Pid_In request parameters, causing the application to return documents, signed consents, signatures, and other protected health information belonging to any patient. This flaw allows a patient who has access to the portal to read or download documents that they should not be able to access, resulting in a privacy breach.

Based on the description, the vulnerability affects all installations of OpenEMR before version 8.3.0, which is inferred to cover releases such as 8.2.x and earlier. Any deployment that has not updated to 8.3.0 or newer is potentially vulnerable. The issue is confined to the portal user interface, so it applies to any site that provides portal account access.

Based on the description, attackers require authentication as a portal patient, so the attack vector is inferred to be remote but authenticated. The CVSS score of 7.1 classifies this flaw as high severity. EPSS data is not available and it is not listed in the CISA KEV catalog. Once the identity of a legitimate patient is known, an attacker can craft API requests to retrieve sensitive documents of other patients. The impact is direct disclosure of PHI and other confidential information, posing a significant privacy and compliance risk.