OpenEMR lacks proper ACL checks on five REST API routes that manage insurance company data. Because the required authorization call is omitted, any authenticated API user can create or modify these records without administrative ACL permissions. This flaw undermines data integrity for insurance records managed by OpenEMR.

The vulnerability impacts all OpenEMR deployments running a version prior to 8.0.0.3. Any installation using the standard REST API interface is susceptible. Versions 8.0.0.3 and later contain a patch that restores the missing authorization checks.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Exploitation requires a valid API authentication token; with it, an attacker can perform data‑modifying operations on insurance company records with no additional privileges. Therefore, only authenticated users can abuse the flaw, and the attack vector is inferred to be API usage.