Improper access control in OpenEMR - #VU158859
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive patient information without the required patient-document or clinical-data permissions.
The vulnerability exists due to improper access control in OpenEMR's portal/lib/download_template.php and DocumentTemplateRender service when rendering document templates for a supplied patient ID. A remote user can submit a POST request with isModule=1, an arbitrary pid, and an installed template_id to bypass patient authorization checks and disclose the target patient's information through the template's patient directives.
The stock Privacy Document discloses identity, date of birth, and chart ID; exposure of additional clinical and contact fields depends on the installed templates.