A broken access control flaw in OpenEMR's message_list.php report export allows users with low privileges, such as receptionists, to request a CSV download that retrieves the entire internal message list containing sensitive patient and user data. The flaw stems from the absence of a permission check before executing the database query; the only safeguard is CSRF token verification, which does not prevent unauthorized data gathering if a token can be obtained or forged.

The vulnerability affects all OpenEMR releases prior to version 8.0.0 across all operating systems. Organizations running these older builds are at risk, irrespective of the underlying platform.

The assigned CVSS score of 6.5 places the issue in the medium severity category. EPSS indicates an exploitation probability below 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker would typically send a crafted request to message_list.php carrying a valid CSRF token and the low‑privilege user's permissions, triggering the export and leaking confidential data.