PT-2026-146779

CVE-2026-126494

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.4.0

Description An improper authorization issue exists in the ScopeRepository::finalizeScopes() function. This occurs because the ScopeEntity::containsScope() function ignores registered permissions, allowing read-only SMART/OAuth clients to obtain write scopes. An attacker with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete patient data or appointments.

Recommendations Update to version 8.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Christos-Cantina-Security

Kojiromike

Mcspicyenjoyer

Vendors

Affected products

Weakness enumeration