OpenEMR’s order types management module contains a broken access control flaw that allows users with low‑privilege roles, such as Receptionist, to add or edit procedure types via the /openemr/interface/orders/types_edit.php endpoint. This unauthorized modification undermines the intended control over procedure catalog entries.

Vulnerable versions are all releases of OpenEMR prior to 8.0.0. The affected product is OpenEMR, an open‑source electronic health records system.

The CVSS score of 8.8 signals a high‑severity issue, while an EPSS score of less than 1 percent indicates a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation is possible via the web interface by any logged‑in user with a low‑privilege role; no elevated permissions or remote code execution are required.