OpenEMR versions earlier than 8.3.0 expose an insecure direct object reference in several encounter‑form view and save endpoints. The flaw allows authenticated clinical users to craft requests that enumerate form identifiers, enabling them to read and overwrite other patients' clinical records. The vulnerability directly undermines the confidentiality and integrity of sensitive patient data and is categorized as CWE‑639.

The affected system is OpenEMR, a widely deployed electronic medical record application. All releases prior to 8.3.0 are vulnerable. Users running any version before the 8.3.0 release are impacted.

The CVSS score of 8.6 indicates high severity. EPSS data is not available; therefore current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but because it requires authenticated access to the web application, a malicious or compromised clinical user could exploit it without needing remote code execution. If proper permission controls are not in place, the attacker can arbitrarily modify or retrieve other patients' records.