Threats tagged 'ghsa-q8w8-wv2v-7crx'

OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the ScopeRepository::finalizeScopes() function. This flaw allows read-only SMART/OAuth clients to escalate privileges and obtain write scopes. Specifically, ScopeEntity::containsScope() does not properly enforce registered permissions, enabling attackers with a client registered for user/<resource>.read to request user/<resource>.write scopes. This can lead to unauthorized creation, modification, or deletion of appointments or patient data.