OpenEMR has a broken access control flaw that permits users with low‑level privileges to view and download Ensora eRx error logs. The logs contain confidential patient and prescription data, so the vulnerability results in the unauthorized disclosure of sensitive information. This is a classic privilege‑escalation problem (CWE‑285) combined with accidental data exposure (CWE‑425).

The flaw affects the OpenEMR electronic health record system, specifically all releases up to and including version 8.0.0.3. Any deployment of those versions that stores Ensora eRx error logs is at risk. No patched version is currently available, so installations remain vulnerable until the vendor publishes a fix.

The CVSS score of 7.7 indicates a high‑to‑medium severity. EPSS is under 1 %, suggesting a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be a legitimate user with low privileges in the system, making the threat most acute for organizations with many low‑privilege accounts that are not properly isolated. If exploited, the attacker could read confidential medical information, potentially leading to privacy violations and regulatory noncompliance.