OpenEMR versions prior to 8.0.0 expose the entire contact information for all users, organizations, and patients in the system to anyone who can use the system/(Group,Patient,*).$export operation along with system/Location.read capabilities, enabling a broad disclosure of personal data. The vulnerability leverages internal server‑to‑server communication that requires a confidential client, secure key exchange, and explicit administrative permission, ensuring that it only manifests in highly trusted environments with existing legal agreements. Consequently, the primary security impact is the loss of confidentiality regarding patient and user contact details.

All openemr:openemr deployments running a version earlier than 8.0.0 are affected. The issue is mitigated in version 8.0.0 and later. Clients configured with the system/Location.read scope or the ability to trigger the Group.$export operation are subject to the disclosure.

The CVSS score is 4.5, indicating moderate complexity and impact. An EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires privileged access to confidential client setups, authenticated system/Location.read permissions, and an administrator who has enabled and granted the necessary scopes, likely restricting attackers to trusted internal or partner clients. Given these constraints, the risk is limited but non‑negligible in environments where such trusted clients exist.