A flaw in OpenEMR’s edih_main.php endpoint allows any authenticated user—including low‑privilege roles such as Receptionist—to retrieve EDI log files by tampering with the log_select GET parameter. The back‑end neglects role‑based access control, permitting read access to logs that are normally protected within the GUI. The vulnerability is a classic Broken Access Control issue, identified as CWE‑284.

Older OpenEMR releases prior to version 8.0.0 are susceptible. Users running the openemr:openemr product with versions earlier than 8.0.0 are at risk; the update to 8.0.0 resolves the flaw.

The CVSS score of 6.5 classifies this as a medium‑severity vulnerability, and the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The flaw does not appear in the CISA KEV list, yet it requires authentication and is therefore likely to be leveraged by internal users or an attacker who has compromised legitimate credentials. Exploitation is straightforward: an attacker logs in, performs a GET request to edih_main.php with a manipulated log_select value, and obtains the log file. No additional privileges or conditions are required beyond authenticated access.