Mcspicyenjoyer

OAuth scope canonicalization and containment flaws allow unauthenticated attackers to obtain unauthorized system-level FHIR (Fast Healthcare Interoperability Resources) access. By registering a client with a colon-form `system:Patient.read` scope, an attacker can bypass approval processes and subsequently request the unregistered `system/Patient.write` scope to read, modify, and create patient records.

An improper authorization issue exists in the `ScopeRepository::finalizeScopes()` function. This occurs because the `ScopeEntity::containsScope()` function ignores registered permissions, allowing read-only SMART/OAuth clients to obtain write scopes. An attacker with a client registered for `user/<resource>.read` can request `user/<resource>.write` to create, update, and delete patient data or appointments.