CVE-2026-126453 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 has an inverted time check in its document expiry logic, so the FHIR Binary download endpoint treats one-hour-limited patient documents as still valid. An authenticated user who still holds access to a Binary resource can keep downloading expired bulk export files and CCD documents with protected health information.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR deployment before 8.5.0 that serves the FHIR Binary endpoint, bulk export, or $docref CCDs is exposed. The attacker must already hold an account with authorization for a Binary resource, so deployments with no FHIR API use or with tight account control face less risk. The sources do not say whether the FHIR API is enabled by default.
Not affected if fhir-disabled, version-8.5.0-or-later
Who cares fhir, healthcare, openemr, phi, self-hosted
8.5.0 are in the affected range.8.5.0 or later, per the NVD range (before 8.5.0).OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.