GHSA-4269-grc6-qr62: OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the setpatient branch. This issue is fixed in version 8.3.0.