The eye exam (eye_mag) view in OpenEMR loads data based on form_id without validating that the data belongs to the user’s current patient or encounter. An authenticated user who knows or guesses another patient’s form identifier can therefore view or edit that patient’s eye exam records. This flaw violates confidentiality and integrity of protected health information and is classified as CWE‑639.

The affected product is OpenEMR, versions up to and including 8.0.0. Any deployment of these releases that permits login access is vulnerable.

The CVSS base score is 6.5, indicating a medium severity vulnerability. The EPSS score is below 1%, suggesting a low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. A threat actor would need valid user credentials and knowledge of a target form_id to exploit the flaw; the attack vector is therefore authenticated access within the application. The vulnerability would allow unauthorized data exposure and potential manipulation of patient records.