The flaw is a missing authorization check in the billing notes module, sl_eob_patient_note.php, allowing any authenticated user to read and alter patient billing information. The absence of proper access control means that users with low‑privilege accounts can enumerate patient records and submit authenticated POST requests with the module’s CSRF token to access or modify billing details that are normally confidential. Because billing data can influence reimbursement and financial records, unauthorized disclosure or manipulation poses a risk of financial loss and exposure of protected health information.

OpenEMR installations running any version prior to 8.3.0, including the 8.2.x line, are affected. The vulnerability is present in the openEMR billing interface that handles statement‑of‑benefits patient notes and does not depend on specific deployment topology.

The CVSS score of 8.6 indicates a high severity and the absence of an EPSS value means an exact exploitation probability cannot be provided. The vulnerability is not listed in CISA’s KEV catalog, but attackers only need authenticated, low‑level access to enumerate patient_id and craft POST requests over the web interface, which is a relatively straightforward path on any exposed OpenEMR site.