CVE-2026-126453

OpenEMR before 8.5.0 contains an inverted comparison in Document::hasexpired that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/id resource can download expired bulk export...