Amendment disclosure and tampering via missing ACL checks

Missing authorization in OpenEMR amendment handlers before 7.0.0.1 allows remote authenticated users to read or alter patient amendments. The list, print, and add/edit handlers processed amendment requests without checking the patients/amendment ACL, and the edit path executed inserts or updates from submitted form data. A signed-in account able to reach these handlers could bypass its assigned amendment permissions and expose or change clinical amendment records.