Improper access control in OpenEMR - #VU158863
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to bypass document category access controls, disclose protected patient documents, and alter their classification.
The vulnerability exists due to missing source-document authorization in OpenEMR's Care Coordination and CCR import controllers when processing a user-supplied document_id. A remote user can submit the global ID of an inaccessible document to an import action to move it into a readable destination category and retrieve its contents through the normal document retrieval endpoint, even if subsequent parsing fails.
Exploitation requires Care Coordination to be enabled and available to the user, with a destination category less restrictive than the document's original category.