Summary
A low-privileged OpenEMR SMART launch user with demographics access could select another patient during authorization and receive a token bound to that patient. The reported test used it to read a clinical note and download a patient document. Affects versions before 8.4.0; fixed in 8.4.0.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified