OpenEMR versions before 8.3.0 contain a missing authorization check and an insecure direct object reference in the oe-module-prior-authorizations module. Authenticated low‑privilege users can request public/reports/list_report.php to list all patients’ names, MRNs, insurance and prior‑authorization data, and can submit arbitrary id values to public/index.php to overwrite other patients’ prior‑authorization records. This allows attackers to view and modify another patient’s sensitive medical and administrative information, compromising confidentiality and integrity.

Affected product is OpenEMR version less than 8.3.0, as identified by the vendor name openemr. All releases prior to 8.3.0 are vulnerable based on the provided CPE string.

CVSS score of 7.1 indicates a high severity. EPSS is not listed, so the current exploitation probability is unknown. The vulnerability is not in CISA KEV, suggesting no confirmed public exploits yet. The attack likely requires authenticated low‑privilege user access within the application, after which the request paths described above can be used. If an attacker has only minimal privileges, the limited access control makes the exploit trivial. Because the flaw is in application‑level authorization, detection may be hard without careful monitoring.