{"id":"CVE-2026-126453","kind":"vulnerability","aliases":["CVE-2026-126453"],"related":[],"title":"OpenEMR: expired patient document downloads stay available past their one-hour lifetime","description":"OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely.","summary":"OpenEMR before 8.5.0 has an inverted time check in its document expiry logic, so the FHIR Binary download endpoint treats one-hour-limited patient documents as still valid. An authenticated user who still holds access to a Binary resource can keep downloading expired bulk export files and CCD documents with protected health information.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fhir","healthcare","openemr","phi","runtime","self-hosted"],"not_affected_if":["fhir-disabled","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version; versions below `8.5.0` are in the affected range.\n- Look for the FHIR Binary endpoint and bulk export use in the deployment, since those are the paths the description names.","fix":"- OpenEMR: move to `8.5.0` or later, per the NVD range (before 8.5.0).","status":"open","published_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","triaged_at":"2026-11-13T10:53:05+00:00","updated_at":"2026-11-13T10:53:05+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:53:05Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later, per the NVD range (before 8.5.0).","reach":"network","title":"OpenEMR: expired patient document downloads stay available past their one-hour lifetime","impact":"high","summary":"OpenEMR before 8.5.0 has an inverted time check in its document expiry logic, so the FHIR Binary download endpoint treats one-hour-limited patient documents as still valid. An authenticated user who still holds access to a Binary resource can keep downloading expired bulk export files and CCD documents with protected health information.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","fhir","healthcare","phi","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authorized users read expired patient documents and PHI indefinitely","analyst_note":"Confirm whether the FHIR Binary endpoint is enabled by default and check the vendor advisory on github.com for the exact fixed version and any setting.","how_to_check":"- Check the installed OpenEMR version; versions below `8.5.0` are in the affected range.\n- Look for the FHIR Binary endpoint and bulk export use in the deployment, since those are the paths the description names.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later","fhir-disabled"],"who_is_affected":"Any OpenEMR deployment before 8.5.0 that serves the FHIR Binary endpoint, bulk export, or $docref CCDs is exposed. The attacker must already hold an account with authorization for a Binary resource, so deployments with no FHIR API use or with tight account control face less risk. The sources do not say whether the FHIR API is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000788,"input_tokens":4624,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126453':16A,19A '-2026':15A,18A '8.5.0':30B,84C 'access':63B 'authent':58B,115C 'author':118C 'avail':7A 'binari':44B,66B,97C,121C 'bulk':72B,127C 'caus':94C 'ccd':76B 'ccds':133C 'check':35B 'comparison':88C 'contain':85C 'cve':14A,17A 'docref':132C 'document':4A,38B,53B,77B,90C,106C 'download':5A,45B,70B,98C,125C 'endpoint':46B,99C 'expir':2A,71B,92C,126C 'expiri':39B 'export':73B,128C 'fhir':20B,43B,96C 'file':74B,130C 'health':80B 'healthcar':21B 'hold':62B 'host':27B 'hour':12A,50B,113C 'id':122C 'indefinit':134C 'inform':81B 'invert':33B,87C 'keep':69B 'lifetim':13A,114C 'limit':51B,104C 'logic':40B 'ndjson':129C 'one':11A,49B,112C 'one-hour':10A,111C 'one-hour-limit':48B 'openemr':1A,22B,28B,82C 'past':8A 'patient':3A,52B 'phi':23B,105C 'protect':79B 'resourc':67B,123C 'runtim':24B 'self':26B 'self-host':25B 'stay':6A 'still':55B,61B,117C 'time':34B,103C 'time-limit':102C 'treat':47B,101C 'unexpir':108C 'user':59B,116C 'valid':56B","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR deployment before 8.5.0 that serves the FHIR Binary endpoint, bulk export, or $docref CCDs is exposed. The attacker must already hold an account with authorization for a Binary resource, so deployments with no FHIR API use or with tight account control face less risk. The sources do not say whether the FHIR API is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fhir","healthcare","high","openemr","phi","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126453':16A,19A '-2026':15A,18A 'avail':7A 'cve':14A,17A 'document':4A 'download':5A 'expir':2A 'hour':12A 'lifetim':13A 'one':11A 'one-hour':10A 'openemr':1A 'past':8A 'patient':3A 'stay':6A","search_b":"'8.5.0':30B 'access':63B 'authent':58B 'binari':44B,66B 'bulk':72B 'ccd':76B 'check':35B 'document':38B,53B,77B 'download':45B,70B 'endpoint':46B 'expir':71B 'expiri':39B 'export':73B 'fhir':20B,43B 'file':74B 'health':80B 'healthcar':21B 'hold':62B 'host':27B 'hour':50B 'inform':81B 'invert':33B 'keep':69B 'limit':51B 'logic':40B 'one':49B 'one-hour-limit':48B 'openemr':22B,28B 'patient':52B 'phi':23B 'protect':79B 'resourc':67B 'runtim':24B 'self':26B 'self-host':25B 'still':55B,61B 'time':34B 'treat':47B 'user':59B 'valid':56B","search_c":"'8.5.0':84C 'authent':115C 'author':118C 'binari':97C,121C 'bulk':127C 'caus':94C 'ccds':133C 'comparison':88C 'contain':85C 'docref':132C 'document':90C,106C 'download':98C,125C 'endpoint':99C 'expir':92C,126C 'export':128C 'fhir':96C 'file':130C 'hour':113C 'id':122C 'indefinit':134C 'invert':87C 'lifetim':114C 'limit':104C 'ndjson':129C 'one':112C 'one-hour':111C 'openemr':82C 'phi':105C 'resourc':123C 'still':117C 'time':103C 'time-limit':102C 'treat':101C 'unexpir':108C 'user':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126453","severity":null,"published_at":"2026-11-13T10:17:53+00:00","modified_at":"2026-11-13T10:17:53+00:00","first_seen_at":"2026-11-13T10:47:23+00:00","fetched_at":"2026-11-13T10:47:23+00:00","note":null}],"documents":[{"id":145150,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-fp98-qfh5-xjhc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:17:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145151,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-inverted-document-expiration-check-exposes-phi-via-fhir-binary","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}