OpenEMR fails to validate user permission in the Care Coordination Module, enabling unauthorized users to view data belonging to authorized users. This results in breached confidentiality of patient information and undermines the privacy guarantees required in healthcare settings.

The vulnerability affects OpenEMR releases prior to version 8.0.0, distributed by the openemr project. Systems running any earlier build are susceptible, while version 8.0.0 and newer contain the fix.

The CVSS score of 7 indicates moderately high severity. The EPSS score of less than 1% suggests a relatively low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker needing only authenticated access to the application to trigger the flaw; exploitation does not require privileged system access.