OpenEMR versions prior to 8.3.0 contain an insecure direct object reference in the OnsiteDocumentController::Query() method. By passing a capitalised Pid parameter, an authenticated patient can bypass the existing lowercase authorization guard, replace the session‑pinned criteria, and request the /api/onsitedocuments endpoint with another patient’s identifier. This allows the attacker to read that patient’s onsite documents, which may include personal health information (PHI). The principal weakness is a CWE‑639 direct object reference vulnerability. The impact is the confidentiality breach of PHI rather than system compromise or denial of service.

OpenEMR 2.x and 3.x deployments running any release before the 8.3.0 release are affected. The vulnerability pertains to the Patient Portal interface for all users authenticated within the portal. The affected product is OpenEMR, with the vendor identified as openemr:openemr.

The CVSS score of 7.1 indicates a high severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. Based on the description, the attack vector operates over the web and requires an authenticated user session; attackers cannot exploit the flaw without first logging into the portal. The ability to read other patients’ documents provides a valuable target for internal attackers or compromised accounts and should be treated with priority. However, the lack of publicly available exploit code or widespread exploitation means the immediate risk, while significant, is moderate relative to more actively exploited vulnerabilities.