{"id":"CVE-2026-126494","kind":"vulnerability","aliases":["CVE-2026-126494"],"related":[],"title":"OpenEMR: read-only OAuth clients can obtain write scopes and change patient data","description":"OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.","summary":"OpenEMR before 8.4.0 fails to enforce a client's registered permissions when issuing OAuth scopes, so a read-only SMART client can request write scopes. An attacker with such a client can create, update, and delete appointments or patient records.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","oauth","openemr","runtime","self-hosted","smart-on-fhir"],"not_affected_if":["no-oauth-clients-registered","openemr-8.4.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; versions before `8.4.0` are affected per the description\n- Check whether SMART/OAuth client registration is enabled and whether any read-only clients are registered","fix":"- OpenEMR: move to `8.4.0` or later (per the description, the fix is in 8.4.0)","status":"open","published_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:52:55+00:00","updated_at":"2026-11-13T10:52:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:52:55Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.4.0` or later (per the description, the fix is in 8.4.0)","reach":"network","title":"OpenEMR: read-only OAuth clients can obtain write scopes and change patient data","impact":"high","summary":"OpenEMR before 8.4.0 fails to enforce a client's registered permissions when issuing OAuth scopes, so a read-only SMART client can request write scopes. An attacker with such a client can create, update, and delete appointments or patient records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","healthcare","smart-on-fhir","oauth","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker modifies or deletes patient data and appointments through OAuth","analyst_note":"Confirm the fixed version and vendor fix details from the GitHub vendor advisory and VulnCheck advisory linked in the sources.","how_to_check":"- Check the OpenEMR version in the installation; versions before `8.4.0` are affected per the description\n- Check whether SMART/OAuth client registration is enabled and whether any read-only clients are registered","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["openemr-8.4.0-or-later","no-oauth-clients-registered"],"who_is_affected":"Clinics and organizations running OpenEMR with SMART/OAuth API clients registered. An attacker needs a registered client with read-only scope, so installations that do not expose the OAuth API to third-party clients are less exposed. The sources do not state further configuration conditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4635,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126494':17A,20A '-2026':16A,19A '8.4.0':34B,75C 'allow':85C 'appoint':69B,118C 'attack':59B,101C 'author':79C 'chang':12A 'client':6A,39B,53B,63B,90C,104C 'contain':76C 'containsscop':97C 'creat':65B,114C 'cve':15A,18A 'data':14A,121C 'delet':68B,117C 'enforc':37B 'fail':35B 'fhir':31B 'finalizescop':83C 'healthcar':21B 'host':27B 'ignor':98C 'improp':78C 'issu':44B 'oauth':5A,22B,45B 'obtain':8A,92C 'openemr':1A,23B,32B,73C 'patient':13A,71B,120C 'permiss':42B,100C 'read':3A,50B,87C,108C 'read-on':2A,49B,86C 'record':72B 'regist':41B,99C,105C 'request':55B,110C 'runtim':24B 'scope':10A,46B,57B,94C 'scopeent':96C 'scoperepositori':82C 'self':26B 'self-host':25B 'smart':29B,52B 'smart-on-fhir':28B 'smart/oauth':89C 'updat':66B,115C 'user':107C,111C 'vulner':80C 'write':9A,56B,93C,112C","nicknames":[],"mitigations":[],"who_affected":"Clinics and organizations running OpenEMR with SMART/OAuth API clients registered. An attacker needs a registered client with read-only scope, so installations that do not expose the OAuth API to third-party clients are less exposed. The sources do not state further configuration conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","oauth","openemr","runtime","selfhosted","smartonfhir"],"campaign_type":null,"search_a":"'-126494':17A,20A '-2026':16A,19A 'chang':12A 'client':6A 'cve':15A,18A 'data':14A 'oauth':5A 'obtain':8A 'openemr':1A 'patient':13A 'read':3A 'read-on':2A 'scope':10A 'write':9A","search_b":"'8.4.0':34B 'appoint':69B 'attack':59B 'client':39B,53B,63B 'creat':65B 'delet':68B 'enforc':37B 'fail':35B 'fhir':31B 'healthcar':21B 'host':27B 'issu':44B 'oauth':22B,45B 'openemr':23B,32B 'patient':71B 'permiss':42B 'read':50B 'read-on':49B 'record':72B 'regist':41B 'request':55B 'runtim':24B 'scope':46B,57B 'self':26B 'self-host':25B 'smart':29B,52B 'smart-on-fhir':28B 'updat':66B 'write':56B","search_c":"'8.4.0':75C 'allow':85C 'appoint':118C 'attack':101C 'author':79C 'client':90C,104C 'contain':76C 'containsscop':97C 'creat':114C 'data':121C 'delet':117C 'finalizescop':83C 'ignor':98C 'improp':78C 'obtain':92C 'openemr':73C 'patient':120C 'permiss':100C 'read':87C,108C 'read-on':86C 'regist':99C,105C 'request':110C 'scope':94C 'scopeent':96C 'scoperepositori':82C 'smart/oauth':89C 'updat':115C 'user':107C,111C 'vulner':80C 'write':93C,112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:16:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126494","severity":null,"published_at":"2026-11-13T10:18:00+00:00","modified_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145231,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6cmr-r2rh-755m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:16:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145232,"url":"https://www.vulncheck.com/advisories/openemr-before-8.4.0-privilege-escalation-via-smart-oauth-scope-finalization","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}