OpenEMR Missing Authorization in FHIR Media and QuestionnaireResponse

Executive Summary

OpenEMR versions before 8.4.0 have a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes. These routes skip Access Control List (ACL) checks, allowing non-patient API tokens without OpenEMR ACLs to request resources by UUID and bypass compartment filtering. This enables reading any patient's documents and questionnaire responses despite lacking proper permissions.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version with: grep -r "version" /var/www/html/openemr/library/CommonFunctions.php. Inspect FHIR routes in apis/routes/_rest_routes_fhir_r4_us_core_3_1_0.inc.php for missing ACL checks. Monitor API logs for unauthorized UUID-based FHIR Media/:uuid or QuestionnaireResponse requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to sensitive patient data, including documents and questionnaire responses. Attackers with non-patient API tokens can read any patient's records by exploiting the missing ACL checks in specific FHIR routes. The impact is limited to read-only access; there is no evidence of write-path exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access to protected health information (PHI). GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for patient data. Unauthorized exposure of PHI can result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Review and apply ACL checks to FHIR Media/:uuid and QuestionnaireResponse routes. Revoke non-patient API tokens lacking proper ACLs. Monitor for unauthorized access attempts in logs.

Useful 0 Not Useful 0