Missing Authorization in OpenEMR Patient Portal Credential Replacement

Executive Summary

OpenEMR before version 8.5.0 has a missing authorization flaw in create_portallogin.php. Low-privilege authenticated users can replace patient portal credentials without proper access control checks. Attackers can select a patient during their session and submit new credentials to hijack portal accounts, access protected health information (PHI), and potentially lock legitimate patients out of their own accounts.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version for versions before 8.5.0. Review logs for unauthorized credential changes in create_portallogin.php. Monitor for unusual patient portal access patterns or locked accounts.

Useful 0 Not Useful 0

Impact Analysis

If you are a patient using OpenEMR's portal, an attacker could take over your account, view your sensitive health data, or prevent you from accessing your own medical records. For healthcare providers, this could lead to data breaches, compliance violations, and reputational damage. The vulnerability allows unauthorized access with low-level user privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates HIPAA due to unauthorized access to PHI and potential data breaches. GDPR compliance could also be impacted if EU patient data is exposed. The flaw undermines access controls required by both regulations, potentially leading to fines, legal action, and mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Review and enforce ACL checks for all user roles. Audit existing portal accounts for unauthorized changes and revoke suspicious credentials.

Useful 0 Not Useful 0