The OpenEMR encounter vitals API accepts an "id" value in a POST request and treats it as an UPDATE operation without verifying that the vital record belongs to the current patient or encounter. An authenticated user who has permission to manage encounters or notes can supply the id of another patient's vital record, causing that record to be overwritten. This permits active tampering of medical data, undermining the integrity of health records and potentially leading to incorrect clinical decisions. The weakness corresponds to CWE‑639, a form of untrusted data manipulation that can yield logical errors and data corruption.

The flaw exists in the OpenEMR application for all releases before version 8.0.0.2. The vendor, OpenEMR, released a fix in release 8.0.0.2 that removes the unchecked update path. Any environment running OpenEMR older than 8.0.0.2 and where users possess encounters/notes permissions is potentially affected.

The CVSS score of 6.5 indicates a moderate severity potential, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid user account with the appropriate permissions, and the attack is performed over the web interface, so it is a remote, authenticated request. The impact is confined to the data of the victim’s records but can be significant within a care setting. Monitoring of unusual overwrite attempts and limiting permission sets can reduce the exploitation window.