CVE-2026-104138: OpenEMR: Missing authorization on QRDA Category I/III download endpoints

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped reportid, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0.