The OpenEMR document controller’s patient_picture context served patient photos by document or patient ID without confirming that the requester was authorized to view that patient. This missing authorization check allows an authenticated user who has basic document ACL permissions to supply any patient identifier and retrieve another patient’s photo, exposing private medical data. The weakness is an access control flaw identified as CWE-639, leading to information disclosure that could compromise patient confidentiality.

OpenEMR OpenEMR versions prior to 8.0.0 are affected. The vulnerability applies to all installations of the document controller’s patient_picture route where the application is running a version older than 8.0.0.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS is less than 1%, showing a very low likelihood of exploitation at the time of this assessment. The issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated user who already has document ACL permissions; no additional privilege escalation is needed to request another patient's photo. Once authorized, the attacker can retrieve the photo directly through the patient_picture endpoint.