OpenEMR’s Layout‑Based Form printable view accepts form identifiers and patient or visit identifiers supplied in the request without verifying that the form actually belongs to the authorized patient or encounter. An authenticated user with LBF‐printing privileges can therefore enumerate form IDs and view or print any patient’s encounter forms, leaking highly sensitive health information. This vulnerability is classified as ©639, which describes an insufficient check of the actions privileges of the user controlling input to sensitive data.

The flaw exists in OpenEMR, under the vendor openemr:openemr, in all releases prior to version 8.0.0. Users deploying those earlier builds are exposed to the risk of unauthorized disclosure of patient forms.

The CVSS score of 6.5 indicates moderate severity, while the EPSS of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known attacks to date. However, the attack vector is feasible for any authenticated user granted LBF printing rights; an attacker with either legitimate credentials or a compromised account can exploit the endpoint. The lack of proven exploitation does not mitigate the confidentiality impact, especially in regulated healthcare settings.