Tike00

An authorization flaw exists in the FHIR implementation where certain read routes skip Access Control List (ACL) checks. This allows users with non-patient API tokens that lack OpenEMR ACLs to request resources using a `uuid`, bypassing compartment filtering. Consequently, an attacker can read documents and questionnaire responses belonging to any patient via the '/FHIR Media/:uuid' and '/QuestionnaireResponse' endpoints.

An authorization bypass exists because the `FhirQuestionnaireResponseService` does not implement `IPatientCompartmentResourceService`. This allows users with patient-scoped SMART tokens to access questionnaire responses belonging to other patients. An attacker possessing a `patient/QuestionnaireResponse.rs` token can request specific responses by uuid or list an unfiltered bundle to retrieve clinical assessment answers across different patients.