OpenEMR versions prior to 8.0.0 are vulnerable to an authorization bypass that exposes sensitive protected health information to any authenticated API client.

The application fails to call the authorization check function within specific REST API routes located in apis/routes/_rest_routes_standard.inc.php. This allows any valid authenticated API user to bypass access control lists and perform unauthorized read or write operations on patient document and insurance records.

The compromise of protected health information (PHI) carries severe regulatory and financial consequences, including potential violations of HIPAA and other healthcare data privacy laws. With a CVSS score of 8.1, this high-severity flaw enables unauthorized data modification and exfiltration, which could lead to significant reputational damage and loss of patient trust in the medical practice.

Immediate Action: Upgrade the OpenEMR installation to version 8.0.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Audit API access logs for anomalous patterns, specifically looking for users accessing document or insurance endpoints that fall outside their typical functional requirements.

Compensating Controls: Implement strict API gateway policies to limit the scope of bearer tokens and restrict access to the REST API to known, trusted IP addresses until the patch is applied.

Public Exploit Available: Unknown.

Given the exposure of sensitive medical data, this vulnerability poses a significant risk to healthcare providers. Administrators must prioritize upgrading to version 8.0.0 immediately to restore proper access control and prevent unauthorized access to patient records.