CVE-2026-126494 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.4.0 fails to enforce a client's registered permissions when issuing OAuth scopes, so a read-only SMART client can request write scopes. An attacker with such a client can create, update, and delete appointments or patient records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations running OpenEMR with SMART/OAuth API clients registered. An attacker needs a registered client with read-only scope, so installations that do not expose the OAuth API to third-party clients are less exposed. The sources do not state further configuration conditions.
Not affected if no-oauth-clients-registered, openemr-8.4.0-or-later
Who cares healthcare, oauth, openemr, self-hosted, smart-on-fhir
8.4.0 are affected per the description8.4.0 or later (per the description, the fix is in 8.4.0)OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.