An IDOR vulnerability in the legacy patient notes module of OpenEMR allows an authenticated user to access or modify any patient note using only the note's identifier. The flaw arises because the code updates or deletes notes by user-supplied IDs without verifying ownership, making it possible to tamper with records that belong to other patients. This can lead to confidentiality and integrity violations of sensitive health information.

The vulnerability affects installations of OpenEMR running versions earlier than 8.0.0.3. The issue resides in library/pnotes.inc.php, a component used by the web UI to handle patient notes. Users should check their deployment against the affected version range and upgrade if necessary.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests low current exploitation probability. Because the flaw resides in the web UI, an attacker needs a logged‑in session to send the note ID, but does not require special privileges. Since the vulnerability is not listed in the CISA KEV catalog, it is not known to be actively exploited in the wild. The primary attack vector inferred is through the note identification field in the web form or URL, with the attacker supplying an arbitrary numeric ID to read or modify unintended notes.