The vulnerability originates from the Message Center accepting the URL parameter show_all and passing it to the backend function getPnotesByUser() which returns all internal messages without verifying that the requester is an administrator. As a result, any authenticated user can view the entire internal message list by requesting messages.php?show_all=yes, exposing confidential communications intended only for authorized personnel. This flaw corresponds to CWE‑639: Privilege Mismatch.

Affected installations are all OpenEMR versions older than 8.0.0. The issue is present in the product from the openemr vendor and is not listed for any other software in the CVE record.

The CVSS score of 5.7 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely an attacker must be an authenticated user with access to the OpenEMR web interface; the exploit would involve sending a request to messages.php?show_all=yes. Because the flaw is an information disclosure that does not require elevated privileges beyond authentication, the risk is moderate but still requires remediation.