OpenEMR versions before 8.4.0 allow an authorization bypass that enables users holding patient-scoped SMART tokens to read questionnaire responses belonging to other patients. The vulnerability originates from the FhirQuestionnaireResponseService not implementing IPatientCompartmentResourceService, so requests for responses by UUID or unfiltered lists return data across compartment boundaries. The impact is a confidentiality breach permitting an attacker to obtain sensitive clinical assessment answers, potentially violating patient privacy and regulatory compliance.

The affected product is OpenEMR, with all releases prior to version 8.4.0. The issue exists in the OpenEMR software itself and is not confined to a particular platform or environment; it applies wherever the vulnerable OpenEMR instance is deployed.

The CVSS score of 7.1 indicates a high severity vulnerability. No EPSS data is available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting it may not be actively exploited yet. The likely attack vector requires an attacker to possess a patient‑scope SMART token with the QuestionnaireResponse.rs permission; once obtained, the attacker can query or enumerate questionnaire responses to gain information about other patients. Because the service ignores compartment filtering, the exploitation does not demand elevated privileges on the server or network and can be performed by any user with a valid SMART token.