OpenEMR versions prior to 8.3.0 contain an insecure direct object reference in the PortalPatientController::Read() method, allowing authenticated patients to request another patient's ID via the patientId query string and retrieve pending demographic change requests. This flaw exposes Protected Health Information, including names, addresses, Social Security Numbers and insurance information, constituting unauthorized disclosure of PHI. The vulnerability can lead to identity theft and violates HIPAA privacy rules. The weakness is classified as CWE-639 insecure direct object reference.

All installations of OpenEMR before version 8.3.0 are affected, as the insecure code resides in the core PortalPatientController. Organizations using any pre‑8.3.0 release must verify the presence of this flaw.

The CVSS score of 7.1 indicates a moderate to high severity. Exploitation requires a legitimate patient account; the attacker can craft a patientId value to read another patient’s data. With the EPSS score unavailable and the issue not listed in CISA’s KEV catalog, the exploit probability appears uncertain but the potential impact is high if an attacker gains access. Immediate remediation is advised, especially for systems storing sensitive patient data.