CVE-2026-126494: OpenEMR before 8.4.0 Privilege Escalation via SMART/OAuth Scope Finalization
OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.4.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenEMR deployments before 8.4.0 that use SMART/OAuth clients are exposed. The issue specifically affects clients registered with read-only user/<resource>.read permissions.
What does an attacker need to exploit it?
An attacker needs a registered SMART/OAuth client with a read scope for a resource. They can then request the corresponding write scope without user interaction.
What access can an attacker gain?
The attacker can obtain write scopes corresponding to their read scopes. This can allow creation, modification, and deletion of appointments or patient data.
Is a default deployment affected?
The available information does not establish whether SMART/OAuth clients or the affected scope configuration are enabled by default. Exposure depends on use of registered SMART/OAuth clients on an affected OpenEMR version.