An Insecure Direct Object Reference exists in OpenEMR’s fee sheet product save logic, allowing a user with fee sheet ACL access to delete, modify, or read drug sales records for any patient by changing a hidden form field. The application accepts the supplied record identifier without verifying ownership or patient context, so the integrity of drug sales data can be compromised and confidential patient information may be exposed.

The vulnerability affects OpenEMR installations before version 8.0.0.3. The patch included in the 8.0.0.3 release eliminates the IDOR flaw. Systems running the affected code base should be identified and upgraded to a non‑vulnerable release.

The CVSS score indicates a moderate severity of 6.5 and the EPSS score is reported as below 1 %, suggesting low current exploit probability. The vulnerability is not listed in CISA’s KEV catalog. The attack requires authentication and possession of fee sheet ACL rights; the likely vectors include web form manipulation or replay of valid requests. Exploitation would enable attackers to compromise patient data integrity and confidentiality.