PT-2026-139999

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move action process to move a document into a patients|demo category, then retrieve ...