OpenEMR's message/note update endpoint performs updates based solely on the supplied message ID and does not verify that the message belongs to the patient associated with the authenticated user. This allows any authenticated user with note permissions to modify another patient's notes by providing a different message ID. The vulnerability enables unauthorized alteration of medical records, compromising the integrity and confidentiality of patient data. The weakness is a classic example of CWE-639 (Authorization Bypass Through User-Controlled Key).

Vendors: openemr; products: openemr. Affected releases are all versions through 8.0.0, including the latest release before the fix commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41. No higher version is listed as affected.

CVSS score 6.5 indicates moderate severity. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with note editing rights, meaning the attack vector is internal or requires compromise of credentials; it is not a remote unauthenticated exploit.