Summary
OpenEMR's FHIR $docref endpoint accepted a caller-selected patient after checking only demographics access. A staff user with demographics and document permissions could generate and download another patient's C-CDA clinical summary through Patient Documents. Affects versions before 8.4.0; fixed in 8.4.0.
Disclosure timeline
- Public disclosure
Credits
Reported by christos-cantina-security; remediation by kojiromike, as credited in OpenEMR's advisory.