OpenEMR, prior to version 8.0.0, exposes all patient documents and insurance data through its REST API because the endpoints skip mandatory authorization checks. Any authenticated bearer token can read or modify this data, which means a malicious or compromised client could retrieve or alter protected health information without consent. This flaw gives attackers a direct path to PHI confidentiality breaches and potential integrity violations.

The flaw affects the OpenEMR openemr product in all releases older than 8.0.0. The patch was applied in version 8.0.0, so any deployment of 7.9.x or earlier is vulnerable.

The CVSS base score of 8.1 indicates a high severity, and the current EPSS score of less than 1 % suggests that exploit attempts are extremely rare at present. The vulnerability is not in the CISA KEV list. Exploitation requires only a valid API bearer token, making it remotely actionable over the internet. Because any authenticated user can abuse the endpoints regardless of ACLs, attackers could achieve wide‑scale PHI exposure or tampering with minimal effort.