drchrono: User with no permissions can create, edit, delete favorite prescriptions /erx/

Hi All, I believe I've found a vulnerability with regards to creating, editing and deleting favorite prescriptions. Description I have a doctor's organization with a staff member who has no permissions. If I visit https://1337test.drchrono.com/erx/ I get permission denied. However, I can create,...