An authorization bypass exists in the patient portal signature endpoint of OpenEMR versions prior to 8.0.0. By submitting a request with type=admin-signature and specifying any provider user ID, an authenticated portal user can upload and overwrite a provider’s signature. This allows an attacker to forge signatures on medical documents, potentially leading to data integrity violations, legal compliance breaches, and fraud.

The vulnerability affects all OpenEMR releases before version 8.0.0. The fix was applied in OpenEMR 8.0.0, which removes the vulnerable endpoint and enforces proper permission checks.

The CVSS score of 8.1 classifies the vulnerability as high severity. EPSS indicates an exploitation probability lower than one percent, but the requirement is only a valid portal login, making the attack vector widely reachable. The issue is not yet listed in the CISA KEV catalog. Exploitation requires authenticated access; the flaw can be leveraged by any portal user to sign documents as a provider without proper authorization. CWE-285 describes the underlying insecure privilege management.