OpenEMR versions prior to 8.3.0 contain a flaw in the SOAP note update API where the system does not verify that the SOAP note identifier supplied in the request belongs to the patient and encounter being targeted. This allows an authenticated user who has permission to manage encounters and notes to submit a request that points to another patient’s note ID, effectively overwriting that note’s contents and reassigning it to a different patient. The consequence is a direct breach of confidentiality, integrity, and potentially availability of protected health information, as clinical notes can be altered or misattributed across patient records.

The vulnerability affects installations of OpenEMR known by the vendor identifier openemr:openemr. All releases older than version 8.3.0 are susceptible, regardless of the specific patch level applied after a prior release. The fix exists in OpenEMR 8.3.0 and later releases, which restore proper ownership checks on SOAP note updates.

The flaw yields a CVSS score of 7.1, indicating a high risk when exploited. No EPSS score is provided, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting it is not widely exploited yet. However, because the API requires authentication, the attack surface is limited to users with encounter and note permissions, but once compromised, the attacker can manipulate any patient’s notes. The lack of external verification or request validation makes this relatively easy to exploit for anyone with valid credentials.