A missing ACL check on the billing file‑download endpoint allows any authenticated OpenEMR user to download and permanently delete claim batch files that contain protected health information. This results in unauthorized disclosure of PHI and potential loss of critical data.

OpenEMR installations running any version prior to 8.0.0.3 are affected. The flaw applies to all affected deployments regardless of user role, as the endpoint accepts authenticated sessions without validating billing privileges.

The CVSS score of 7.6 denotes a high severity, and the EPSS score of less than 1% suggests a low probability of observed exploitation. Nonetheless, because the vulnerability can be triggered by any logged‑in user, the risk to organizations handling PHI is significant. The fix is to apply the vendor patch; in the absence of a patch, accessing the endpoint without proper ACL checks is a serious security concern.