OpenEMR versions prior to 8.0.0.3 contain an improper access control that allows users who are not granted permission to import or export through the UI to perform those actions by manipulating requests directly. This flaw can lead to unauthorized data access, bulk data extraction, or manipulation of system data, posing a risk to confidentiality and integrity of patient information.

The vulnerability affects the openemr openemr application. All releases before version 8.0.0.3 are affected, while version 8.0.0.3 incorporates a fix.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not in the CISA KEV catalog. Based on the description, the attack vector is inferred to be direct request manipulation over the web interface, which may be carried out remotely by an attacker with network access to the application.