Authorization Flaw in SmileCDR HAPI FHIR

CVE-2026-113876

What is CVE-2026-113876?

SmileCDR HAPI FHIR presents an authorization vulnerability that fails to properly validate permissions for conditional create actions. A user granted CREATE permissions without corresponding READ permissions can exploit this flaw to perform conditional creates, potentially retrieving sensitive content from existing resources that match their predicates. This oversight could lead to unauthorized data access and poses a risk to sensitive information security.

References