Aquibaquil

An authorization flaw exists in the FHIR implementation where certain read routes skip Access Control List (ACL) checks. This allows users with non-patient API tokens that lack OpenEMR ACLs to request resources using a `uuid`, bypassing compartment filtering. Consequently, an attacker can read documents and questionnaire responses belonging to any patient via the '/FHIR Media/:uuid' and '/QuestionnaireResponse' endpoints.

An authorization bypass exists because the `FhirQuestionnaireResponseService` does not implement `IPatientCompartmentResourceService`. This allows users with patient-scoped SMART tokens to access questionnaire responses belonging to other patients. An attacker possessing a `patient/QuestionnaireResponse.rs` token can request specific responses by uuid or list an unfiltered bundle to retrieve clinical assessment answers across different patients.

Write actions within `controllers/C Document.class.php`, specifically the `move action process()` function, fail to verify if the caller has appropriate access to the source document, the current patient and category, or the destination patient and category before the `Document::change patient()` function performs the mutation. This allows a low-privilege authenticated user to reassign an arbitrary document to a patient or category they can access, subsequently enabling them to retrieve the document through the standard protected read path. Because the reassignment happens before the final list rendering check, an HTTP 403 response does not indicate that the unauthorized write operation was blocked.