OpenEMR versions before 8.4.0 contain an authorization bypass in the FHIR endpoint that allows a patient‑portal user to read any staff member’s demographics by calling GET /fhir/Person/:uuid without respecting compartment enforcement. This flaw is an instance of Improper Authorization (CWE‑284) and enables the disclosure of personally identifying information such as names, addresses, phone numbers, and email addresses. The impact is a privacy breach that could lead to identity theft if the harvested staff data is exploited.

The vulnerable software is OpenEMR prior to version 8.4.0. Users running any of these versions are affected by the bypass and should verify whether their installations expose the FHIR Person endpoint to patient users.

The CVSS score of 7.1 indicates a moderate to high severity, and the vulnerability was not yet listed in the CISA KEV catalog. Its exploitation requires a patient SMART token with the patient/Person.read scope, which a legitimate portal user may possess. Because the attackers do not need elevated system privileges, the attack vector is likely remote via the web portal, and attackers can harvest numerous staff Person UUIDs from Appointment references to gather sensitive data.