A patient‑scoped authorization bypass in the FHIR CareTeam resource endpoint allows an authenticated patient to retrieve care team information for all patients, potentially exposing protected health information such as patient‑provider relationships and care team structures. The flaw is rooted in the FhirCareTeamService missing the required IPatientCompartmentResourceService implementation, which bypasses the patient compartment filtering mechanism. This is a notable confidentiality breach, categorized under CWE‑200 and CWE‑863.

The vulnerability affects OpenEMR deployments using versions prior to 8.0.0. Any installation running an older release exposes patient data across the entire system when accessed through the FHIR CareTeam endpoint.

The CVSS score of 5.7 indicates medium severity, and an EPSS score of less than 1% signals a very low yet nonzero probability of exploitation. Because the flaw is remote and only requires possession of a valid patient‑scoped FHIR token, an attacker can use standard network access to the server to read PHI, though the lack of KEV status and low EPSS suggest no confirmed exploits yet. The lack of an enforced compartment filter means the attack path is straightforward: authenticate as a patient and query the CareTeam resource, which returns data from all patients.