OpenEMR versions prior to 8.3.0 suffer from a missing authorization and Insecure Direct Object Reference vulnerability in the sl_eob_invoice.php interface. This flaw allows any authenticated user to read and modify billing details for any encounter, including patient names, billing notes, payments, adjustments, deletions, and other sensitive data. The vulnerability is rooted in CWE-639, which permits an attacker to manipulate request parameters to obtain information or perform actions that should be restricted.

The affected product is OpenEMR, released through the openemr:openemr vendor channel. Only installations running versions earlier than 8.3.0 are susceptible; newer releases include the fix. No specific build or patch numbering beyond the stated version demarcation is available.

The CVSS score of 8.6 indicates a high severity. EPSS data is not available, but the lack of mitigation and the ability to iterate the id parameter suggest a moderate to high likelihood of exploitation, especially in environments with broad user roles or weak access controls. The vulnerability is not currently listed in the CISA KEV catalog, but its impact over billing data and potential financial and privacy consequences warrant immediate attention.