Vulnerability record/PUBLISHED/Published Nov 13, 2026 09:34:58 UTC
CVE-2026-126473
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.
Base score9.3/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 13, 2026 18:41:27 UTC
PublishedNov 13, 2026 09:34:58 UTC
ReservedNov 10, 2026 21:42:24 UTC
Credits
- mcspicyenjoyer