SmileCDR HAPI FHIR vulnerabilities

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust server heap or crash certain services when decompressed.