Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patient_file/download_template.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T20:17:39.603Z",
  "pubdate": "2026-11-05T20:17:39.603Z",
  "executiveSummary": "OpenEMR versions prior to 8.3.0 contain an improper authorization vulnerability that permits authenticated users to access sensitive patient health information without proper permission checks. This vulnerability stems from a lack of Access Control List (ACL) validation within the session management and template download workflows. By manipulating the session-based patient identifier, a low-privilege attacker can bypass authorization constraints and access unauthorized medical records, including demographics, medication history, and problem lists. The flaw necessitates an active session, but does not require administrative privileges, posing a significant risk to the confidentiality of protected health information (PHI) within clinical environments. The vulnerability has been remediated in version 8.3.0.",
  "technicalDetails": "The vulnerability resides in the interaction between library/ajax/set_pt.php and interface/patient_file/download_template.php within the OpenEMR framework. The root cause of the security failure is a decoupling of session state management from robust authorization enforcement. Specifically, library/ajax/set_pt.php allows an authenticated user to perform a state-changing operation that sets an arbitrary patient identifier in the active PHP session. The application fails to perform an ACL check during this process, allowing a user to point the session toward a patient record they are not authorized to view.\nThe subsequent exploitation utilizes interface/patient_file/download_template.php. This script assumes the patient identifier stored within the current session is valid and authorized for the user, focusing exclusively on CSRF validation rather than verifying whether the authenticated user holds the required permissions to access the specified patient's files or documents. Because the session variable has been manipulated, the application renders document templates containing highly sensitive data—such as demographics, encounter history, allergy profiles, medication lists, and problem lists—under the guise of an authorized request.\nThe attack flow proceeds as follows: 1) The attacker establishes a legitimate, low-privilege session within the OpenEMR instance. 2) The attacker sends a request to library/ajax/set_pt.php, injecting a target patient identifier into the session object. 3) The attacker triggers interface/patient_file/download_template.php. 4) The server-side script retrieves the malicious identifier from the session, fails to perform an ACL validation against the current user's privileges, and proceeds to generate and serve the requested document template. 5) The attacker receives the rendered document containing unauthorized PHI.\nThis vulnerability is classified as an improper authorization flaw, specifically targeting the logic used to gate access to protected medical record components. It affects all OpenEMR versions prior to 8.3.0. Exploitation is limited to authenticated users; however, the lack of granular privilege checking allows any user with standard account access to perform horizontal or vertical privilege escalation concerning patient record data. The exposure is limited to the server-side generation of patient document templates, which effectively bypasses existing system-wide security controls for patient data access."
}