CVE-2026-126494
Awaiting Analysis Awaiting Analysis - Queue

Improper Authorization in OpenEMR Leading to Unauthorized Write Access

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126494
EUVD
EUVD-2026-125130

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.4.0 has a flaw in its SMART/OAuth scope handling. The system allows read-only clients to request and receive write permissions during token finalization. This happens because the scope validation incorrectly trusts legacy aliases like 'read' or 'write' without checking actual registered permissions. As a result, attackers with a read-only client can gain write access to modify appointments or patient data.

Detection Guidance

Check OpenEMR version with: grep -r "openemr" /var/www/html/openemr/version.php. If version is below 8.4.0, the system is vulnerable. Review OAuth/SMART client registrations for read-only clients requesting write scopes in logs or database.

Impact Analysis

If you use OpenEMR versions before 8.4.0, an attacker could exploit this to gain unauthorized write access. They could create, update, or delete appointments and patient data even if their client was only approved for read-only access. This could lead to data tampering, unauthorized modifications, or loss of data integrity.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized modifications to patient data. GDPR requires strict access controls and data integrity, while HIPAA mandates protection against unauthorized changes. Exploitation could lead to unauthorized data breaches or integrity violations, potentially resulting in legal and financial penalties.

Mitigation Strategies

Upgrade OpenEMR to version 8.4.0 or later immediately. Review and revoke any unauthorized write scopes granted to read-only clients. Audit all OAuth/SMART client registrations to ensure proper scope permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...