OpenEMR versions prior to 8.3.0 contain a broken object‑level authorization flaw in portal/report/portal_custom_report.php. An authenticated portal patient can manipulate the issue_ parameter and retrieve other patients' problem list entries, including titles, clinical notes, ICD diagnosis codes and IPPF contraceptive records, resulting in a confidentiality breach of sensitive medical information.

The vulnerability affects any OpenEMR installation running a version earlier than 8.3.0. The product is sold by OpenEMR (openemr:openemr).

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The exploit requires an authenticated portal patient, a common authentication vector for patients. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed. Attackers can enumerate sequential issue_ values to retrieve sensitive patient data, so the risk persists until the fix is deployed.