A critical authorization bypass vulnerability in OpenEMR allows authenticated users to manipulate sensitive patient medical records, necessitating an immediate update to version 8.0.0.3.

The vulnerability is an Insecure Direct Object Reference (CWE-639) located within the library/pnotes.inc.php file. It allows any authenticated user to perform unauthorized update or delete operations on patient notes because the application fails to verify ownership or access permissions for the provided note ID.

The ability for unauthorized users to modify or delete medical records poses a severe risk to patient safety, clinical data integrity, and regulatory compliance. Given the CVSS score of 8.1, this vulnerability represents a high risk of data tampering and loss of confidentiality. Unauthorized manipulation of electronic health records can lead to significant legal liability, reputational damage, and disruption of critical medical services.

Immediate Action: Upgrade your OpenEMR deployment to version 8.0.0.3 or later immediately to apply the required authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of note deletions or modifications that deviate from standard user workflows.

Compensating Controls: While no direct WAF rule can replace the patch, strictly restricting access to the OpenEMR interface to authorized users only via VPN or IP allowlisting can reduce the attack surface.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant risk to the integrity of medical data within the OpenEMR platform. Security teams must prioritize patching to version 8.0.0.3 to remediate the broken access control mechanism. Failure to update leaves clinical records vulnerable to unauthorized tampering by any user with valid system access.