CVE-2026-126453: OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary
OpenEMR before 8.5.0 contains an inverted comparison in Document::hasexpired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely.
Affected Software
Event History
Frequently Asked Questions
Who can access the expired documents?
An attacker must be authenticated and remain authorized to access the specific FHIR Binary/{id} resource. The issue exposes expired bulk export NDJSON files and $docref CCDs to such users.
Is an affected document unavailable after its intended one-hour lifetime?
No. The inverted expiration comparison causes time-limited documents to be treated as unexpired after their one-hour lifetime, allowing authorized users to download them indefinitely.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. The affected behavior is in the FHIR Binary download endpoint.