OpenEMR’s ACL check function fails to honor explicit deny rules, allowing any user or group that has an allow entry to bypass security restrictions. The flaw means that administrators cannot revoke access by setting a deny, so users can gain unauthorized privileges to access sensitive features or data. This can compromise both confidentiality and integrity of patient records.

The vulnerability affects OpenEMR version 8.0.0 and earlier, up to but not including the patched release 8.0.0.2. Any installation of 8.0.0.0 or 8.0.0.1 is impacted. Operators should confirm which minor release they are running and apply the corrected version if necessary.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA known exploited vulnerabilities catalog. The flaw can be abused by authenticated users who can modify ACL settings, likely through the web interface or administrative console. An attacker could elevate privileges by ensuring an allow rule exists for a target user, thereby bypassing any explicit deny entries. The impact can extend to unauthorized access to patient data and system configuration.