GHSA-phvv-q7m7-8mc2: OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/importtemplate.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=saveprofiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated OpenEMR staff user can exploit the unguarded portal document template modes. Administrative or forms-specific ACL permissions are not required for the affected actions.
What access does an attacker need?
The attacker needs valid authenticated staff access and network access to the affected OpenEMR instance. No user interaction is required.
What actions can exploitation enable?
An authenticated staff user can delete all template profile assignments with mode=save_profiles, push templates to patients, change template categories, and read template bodies using mode=get or mode=getPdf.
How can I determine whether my deployment is affected?
Deployments running OpenEMR versions before 8.5.0 are affected. Review whether portal/import_template.php is reachable by authenticated staff users and inspect template profile assignments, patient template delivery, category changes, and template reads for unexpected activity.