An inverted boolean condition in OpenEMR's ControllerRouter::route() causes the admin/super ACL check to be applied only to controllers that already perform internal authorization, while leaving other clinical decision support (CDR) controllers—such as alerts, ajax, edit, add, detail, and browse—accessible to any authenticated user. The flaw permits logged‑in users to suppress system‑wide alerts, delete or modify clinical plans, and edit rule configurations that should be restricted to administrators. The vulnerability represents a breach of access control, identified as CWE‑862.

All OpenEMR installations using version 8.0.0.0 or earlier are vulnerable. The vendor, openemr, lists OpenEMR as the affected product, and the issue is fixed in release 8.0.0.1.

The CVSS v3 score of 7.1 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of widespread exploitation. The flaw requires only authenticated access and does not grant privilege escalation on the host; it is not listed in CISA's KEV catalog, meaning no public exploits are documented. Exploitation is possible through any authenticated user session, allowing the attacker to modify critical clinical data.