CVE-2026-113876
MediumCVSS 4.3Summary
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
Risk Assessment
This can lead to disclosure of resource data to users who lack read permissions.
Recommendation
Update SmileCDR HAPI FHIR to a patched version and review authorization rules for conditional create operations.
Other vulnerabilities in SmileCDR HAPI FHIR
See all- CVE-2026-113875Low
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.
- CVE-2026-113874High
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
- CVE-2026-113873High
SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust server heap or crash certain services when decompressed.
Original NVD description (English source)
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS