A missing authorization vulnerability in OpenEMR allows any authenticated user to unauthorizedly download and delete sensitive electronic claim batch files containing protected health information.

The billing file-download endpoint at interface/billing/get_claim_file.php fails to perform adequate access control list (ACL) checks, requiring only a valid session and CSRF token. Consequently, any authenticated user, regardless of their role or assigned privileges, can trigger the download and permanent deletion of sensitive electronic claim batches.

The exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of sensitive patient data, leading to potential HIPAA non-compliance and severe regulatory penalties. Given the CVSS score of 7.6, this is classified as a high-severity risk that could result in substantial reputational damage and the loss of sensitive Protected Health Information (PHI) through unauthorized deletion or exfiltration.

Immediate Action: Update OpenEMR to version 8.0.0.3 or later immediately to apply the necessary ACL verification logic.

Proactive Monitoring: Review application access logs specifically for frequent or anomalous requests to the interface/billing/get_claim_file.php endpoint, particularly from user accounts that do not require billing access.

Compensating Controls: Implement strict network-level segmentation and restrict access to the billing management modules via internal Role-Based Access Control (RBAC) configurations if an immediate update is not feasible.

Public Exploit Available: No

This vulnerability represents a critical failure in access control that directly exposes Protected Health Information to unauthorized users. Organizations utilizing OpenEMR must prioritize the upgrade to version 8.0.0.3 to ensure that the billing file-download endpoint correctly enforces authorization checks. Failure to remediate this issue leaves the medical practice exposed to data loss and potential legal liability regarding the unauthorized handling of patient records.