OpenEMR Missing Authorization Vulnerability in Insurance Company API Routes

A vulnerability exists in OpenEMR versions prior to 8.0.0.3, where five insurance company REST API routes lack the necessary authorization checks. This omission allows any authenticated API user to create and modify insurance company records, regardless of their administrative permissions. The affected routes are in the standard API and include various data-modifying operations. The vulnerability could disrupt billing workflows and insurance claim processing by unauthorized modifications to insurance records.

Impact

Exploitation of this vulnerability allows unauthorized users to create and modify insurance company records, potentially disrupting billing workflows and insurance claim processing.

Remediation

Users can upgrade to OpenEMR version 8.0.0.3, which addresses this vulnerability by adding the necessary authorization checks on the affected API routes. Instructions for downloading this version are available on the OpenEMR GitHub releases page.