PT-2026-146758

CVE-2026-126473

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description OAuth scope canonicalization and containment flaws allow unauthenticated attackers to obtain unauthorized system-level FHIR (Fast Healthcare Interoperability Resources) access. By registering a client with a colon-form system:Patient.read scope, an attacker can bypass approval processes and subsequently request the unregistered system/Patient.write scope to read, modify, and create patient records.

Recommendations Update to version 8.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Mcspicyenjoyer

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers