CVE-2026-126494
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.