CVE-2026-113874
HighCVSS 8.1Summary
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Risk Assessment
Tenant isolation can be broken, allowing unauthorized access to other tenants' data. This may lead to leakage or modification of medical data and compliance violations.
Recommendation
Apply the fix or configuration that enforces storage partition entitlement as recommended by the vendor. Verify that trusted sources are clearly distinguished from untrusted bundle bodies.
Other vulnerabilities in SmileCDR HAPI FHIR
See all- CVE-2026-113876Medium
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
- CVE-2026-113875Low
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.
- CVE-2026-113873High
SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust server heap or crash certain services when decompressed.
Original NVD description (English source)
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS