Cyberkareem

An authorization bypass exists in the FHIR GET '/fhir/Person/:uuid' endpoint. This issue allows users of the patient portal to bypass compartment enforcement—a security mechanism used to isolate data—and access demographics of any staff member. An attacker possessing a patient SMART token with `patient/Person.read` permissions can obtain staff Person `uuid` values from Appointment references to retrieve sensitive information, including names, home addresses, phone numbers, and personal emails.

An insecure direct object reference occurs in multiple encounter-form view and save endpoints due to a lack of patient or encounter ownership verification. Authenticated clinical users can enumerate sequential form ID values in requests to the 'soap/view.php' and 'save.php' endpoints to read and overwrite clinical records belonging to other patients.

An authorization bypass exists because the `FhirQuestionnaireResponseService` does not implement `IPatientCompartmentResourceService`. This allows users with patient-scoped SMART tokens to access questionnaire responses belonging to other patients. An attacker possessing a `patient/QuestionnaireResponse.rs` token can request specific responses by uuid or list an unfiltered bundle to retrieve clinical assessment answers across different patients.

A flaw exists in the `src/Common/Auth/OneTimeAuth.php` file where the system ignores the `enforce onetime use` and `max access count` flags. Additionally, the system fails to revoke consumed `service auth` tokens and performs checks on the `login pin` without rate limiting or strict comparison. This allows an attacker with a captured token to replay it or brute-force the PIN to gain unauthorized access to patient-portal sessions, potentially exposing Protected Health Information (PHI).

An insecure direct object reference exists in the `OnsiteDocumentController::Query()` function. Authenticated portal patients can access documents belonging to other patients by overriding the `Pid Equals` criteria. By supplying the `Pid Equals`, `Pid GreaterThan`, or `Pid In` parameters to the 'onsitedocuments' API endpoint, an attacker can retrieve protected health information (PHI), signatures, and signed consent forms of any patient.

The `oe-module-prior-authorizations` module contains missing authorization and insecure direct object reference (IDOR) issues. These flaws allow authenticated users with low privileges to access and modify records belonging to other patients. An attacker can access the 'public/reports/list report.php' endpoint to view patient names, Medical Record Numbers (MRNs), insurance, and prior-authorization data. Additionally, by submitting arbitrary `id` values to the 'public/index.php' endpoint, an attacker can overwrite prior-authorization records of other patients.

An issue exists in the 'interface/billing/sl eob process.php' endpoint where authenticated users can perform path traversal by providing unsanitized values in the `eraname` variable. This allows attackers, including those without billing privileges, to use ../ sequences to create ERA report .html files in any directory writable by the web user and parse arbitrary .edi files (Electronic Data Interchange files used for healthcare transactions) that are echoed into the report.

Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

An issue exists in the DORN module where the endpoint 'interface/modules/custom modules/oe-module-dorn/public/compendium install.php' fails to enforce the admin/users Access Control List (ACL), despite verifying authentication and Cross-Site Request Forgery (CSRF) protections. A low-privilege authenticated user can provide a specific `labGuid` value, triggering the `LabCompendiumInstall::uninstall()` function. This process deletes detail and result procedure types and deactivates order types, which can corrupt the lab-ordering configuration and necessitate a manual restoration of the compendium by an administrator.

An issue exists where specific endpoints validate CSRF but fail to enforce the patients/med ACL (Access Control List), which is used by the canonical CQM report page. These endpoints accept an unscoped `report id` variable, enabling a low-privilege authenticated user to access report generation and download logic for reports they are not authorized to view. This can lead to the exposure of QRDA Category One and Category Three clinical documents for patients within a measure. The affected endpoints are 'custom/ajax download.php', 'custom/download qrda.php', 'custom/export qrda xml.php', and 'custom/qrda download.php'.

In the file `library/classes/Controller.class.php`, the `checkControllerAcl()` function fails to enforce permissions for controllers missing from the `CONTROLLER ACL MAP`. This fail-open dispatcher allows a low-privilege authenticated user to bypass access control lists (ACL) and invoke administrative controllers. Specifically, an attacker can use `C X12Partner::edit action process()` to create or modify insurance-routing hosts and credentials, or use `C PatientFinder::find action process()` to enumerate patient identifiers, names, and dates of birth. This issue also exposes other administrative controllers intended to be restricted via Practice Settings routes.

The `userSessionLogout()` function in `src/RestControllers/AuthorizationController.php` uses `decodeToken()` to process an `id token hint` without verifying its signature. If the referenced trusted session is missing, the application redirects to the `post logout redirect uri` provided by the caller before validating it against the registered client redirect URIs. This allows an unauthenticated attacker to create a logout link that invalidates a user session and redirects the user to an arbitrary external site, facilitating phishing attacks. This issue is accessible when the OpenEMR REST API is enabled.

The application lacks Access Control List (ACL) and Cross-Site Request Forgery (CSRF) checks in the 'interface/modules/custom modules/oe-module-weno/scripts/file download.php' endpoint and ignores the result of the `validateAdminCredentials()` function. When the Weno module is active, the default GET path triggers the `PharmacyService::removeWenoPharmacies()` function before a refetch attempt. This allows any authenticated user or a cross-site request via a logged-in victim to truncate the `weno pharmacy` table, potentially leaving the e-prescribing pharmacy directory empty and unavailable if a subsequent download fails.

An issue exists where the plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with Subscriber-level access, to read sensitive HR, CRM, and Accounting data belonging to other users by enumerating record identifiers.

Authenticated users with read access to centers or targeted datatables can perform time-based blind SQL injection. This occurs because the application concatenates caller-supplied ordering parameters directly into the SQL ORDER BY clause, bypassing existing regex-based input validation. The affected API endpoints are '/api/v1/centers', '/api/v1/datatables/{datatable}/{apptableId}', and '/api/v1/datatables/{datatable}/{apptableId}/{datatableId}'. The vulnerable parameters are `orderBy`, `sortOrder`, and `order`.

An authorization bypass exists in the `DeleteTaskScheduleService` and `SetActiveOnTaskScheduleService` functions. This flaw allows authenticated users to delete or disable schedules belonging to other organizations. An attacker can execute these actions by sending requests through their own project's schedule route using a victim's `friendlyId` to destroy IMPERATIVE cron schedules (time-based job schedulers).

An authorization bypass exists in the `createDeploymentBackgroundWorkerV4()` function. The system resolves a WorkerDeployment using only the `friendlyId` without verifying the environment, project, or organization scope. An attacker with a valid environment API key can send a POST request to the deployment background-workers endpoint using a victim's deployment ID to redirect an in-progress deployment to a worker within the attacker's own environment.

An issue exists where the REST API does not restrict the related objects an anonymous visitor can include when reading a single upsell funnel. Additionally, the system fails to strip private fields from these objects. This allows unauthenticated users to access merchant-private catalog data, including pricing, commission, stock, SKU, and tax internals, as well as unpublished products.