A missing authorization check in the upload.php script allows any authenticated user to supply an arbitrary doc_id and read or overwrite the associated medical record. Because the endpoint does not enforce role or ownership checks, low‑privilege users can enumerate document identifiers through existing fetch and save actions, revealing protected health information and corrupting records for any patient.

The vulnerability affects installations of OpenEMR version 8.2.x and earlier. Users running OpenEMR 8.2.0 through 8.2.9 (or any unreleased 8.2 release) are potentially affected. The version range is inferred from the description.

The CVSS score of 8.6 classifies this flaw as high severity. While the EPSS value is not publicly available, the lack of an authorization gate suggests that exploitation is straightforward for an authenticated attacker. The vulnerability is not listed in the CISA KEV catalog, but its impact on confidential medical records makes it a high‑priority issue for healthcare organizations.