CVE-2026-113875
LowCVSS 3.1Summary
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.
Risk Assessment
This can lead to unauthorized disclosure of medical or other protected FHIR resources. It breaches confidentiality and may cause regulatory non-compliance.
Recommendation
Restrict subscription-creation permissions to trusted accounts and enforce server-side authorization checks. Consider upgrading to a version containing a fix if available.
Other vulnerabilities in SmileCDR HAPI FHIR
See all- CVE-2026-113876Medium
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
- CVE-2026-113874High
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
- CVE-2026-113873High
SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust server heap or crash certain services when decompressed.
Original NVD description (English source)
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS