Description
OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Emr | OpenEMR | 0 <8.5.0 | — |