A critical authorization bypass vulnerability in OpenEMR allows authenticated users to retain access despite explicit administrative denials, posing a significant risk to data privacy and system security.

The application utilizes an incorrect authorization mechanism within the AclMain::zhAclCheck function, which only evaluates positive allow permissions while ignoring explicit deny configurations. This flaw allows any authenticated user to bypass access restrictions if they belong to a group with conflicting permissions.

The inability to effectively revoke access for specific users or groups undermines the principle of least privilege within a medical practice management environment. Given the high CVSS score of 8.1, this flaw could lead to unauthorized access to sensitive electronic health records, potentially resulting in severe regulatory non-compliance, patient privacy violations, and significant reputational damage.

Immediate Action: Upgrade the OpenEMR installation to version 8.0.0.2 or later to apply the necessary logic corrections to the ACL module.

Proactive Monitoring: Review audit logs for unexpected access patterns by users whose privileges were intended to be revoked or restricted.

Compensating Controls: While no direct WAF rule can fully remediate this logic flaw, administrators should audit user group memberships to ensure that no users with restricted roles are currently assigned to broader groups that inherit access permissions.

Public Exploit Available: Unknown

This vulnerability represents a significant failure in access control, which is critical for clinical environments managing protected health information. Organizations must prioritize the transition to version 8.0.0.2 to ensure that administrative deny rules are enforced correctly, thereby restoring proper security boundaries for user access.