OpenEMR’s portal payment endpoint allows a logged‑in portal user to supply a patient identifier in the request that is not checked against the authenticated session. By overriding the backend patient id, the attacker can view the demographics, invoices, and payment history of any other patient. This privilege escalation bypasses the normal patient‑level access controls and compromises the confidentiality and integrity of protected health information, as described by CWE‑639.

The vulnerability exists in OpenEMR versions prior to 8.0.0. The affected file is portal/portal_payment.php. All installations of OpenEMR that use the default portal login mechanism and have not applied the 8.0.0 update are at risk. No specific patch version list is given beyond the 8.0.0 fix.

The CVSS score of 7.1 indicates a medium‑high severity vulnerability. The EPSS score of less than 1 % suggests that, while the technical exploit is possible, it is unlikely to be widely used or automated at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs a valid portal session and the ability to modify the request parameters; no additional privileges or network access are required. Because the flaw allows read‑only access to other patients’ data, the exploitation is straightforward and could be performed interactively by a legitimate user after logging in.