A missing authorization check in the show-signature.php script allows any authenticated patient portal user to request and retrieve any staff member’s signature image by supplying an arbitrary user identifier in the POST body. This flaw is an example of authorization bypass and missing authorization for a critical function. The result is that private staff signature images can be exposed without permission.

OpenEMR versions earlier than 8.0.0.3 that expose the portal/sign/lib/show-signature.php endpoint are affected. Any deployment that permits authenticated patients to access the patient portal and POST requests to this endpoint is vulnerable.

The CVSS score of 4.3 indicates moderate severity. The estimated exploitation probability is reported as less than 1%, and it is not listed in the Known Exploited Vulnerabilities catalog, implying a low likelihood of real-world attacks. An attacker only needs to be an authenticated patient and send a POST request; no additional privileges are required. The impact is limited to the confidential disclosure of staff signatures and does not allow further system compromise.