Authorization Flaw in SmileCDR HAPI FHIR Enables Cross-Tenant Data Access
CVE-2026-113874

8.6HIGH

Key Information:

Vendor

Smilecdr

Status
Hapi Fhir
Vendor
CVE Published:
22 October 2026

What is CVE-2026-113874?

SmileCDR HAPI FHIR has a vulnerability that allows an attacker who is authorized for one tenant to access or manipulate data in another tenant's partition due to improper enforcement of storage partition entitlement. This occurs when an untrusted bundle body can replace a partition identity established by a trusted source, leading to potential unauthorized data exposure across tenant boundaries.

Affected Version(s)

HAPI FHIR 0

References

https://www.cve.org/CVERecord?id=CVE-2026-113874
vdb-entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal
.