A broken access control vulnerability in OpenEMR versions prior to 8.0.0 allows low-privilege users to perform unauthorized administrative actions, posing a significant risk to data integrity.

This is a missing authorization flaw (CWE-862) located in the /openemr/interface/orders/types_edit.php endpoint. The vulnerability allows an authenticated user with low privileges, such as a receptionist, to add or modify medical procedure types without the required administrative permissions.

Successful exploitation of this flaw allows unauthorized actors to manipulate critical clinical data structures within the medical practice management system. Given the CVSS score of 8.8, this vulnerability presents a high risk of operational disruption and potential compromise of sensitive health records, which could lead to severe reputational damage and regulatory non-compliance.

Immediate Action: Upgrade the OpenEMR installation to version 8.0.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Review audit logs for unexpected modifications to procedure types or clinical order configurations occurring from accounts with limited user roles.

Compensating Controls: Implement strict network-level access controls and ensure that only authorized personnel have authenticated access to the management interface until the patch can be applied.

Public Exploit Available: No

Given the high severity of this vulnerability and the potential for unauthorized manipulation of clinical records, it is imperative that organizations running OpenEMR prioritize the upgrade to version 8.0.0. Failure to patch allows low-privilege accounts to perform actions intended for administrators, creating a clear pathway for potential system sabotage or data corruption.