Vulnerability Description
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/
- https://www.cve.org/CVERecord?id=CVE-2026-113874
FAQ
What is CVE-2026-113874?
CVE-2026-113874 is a vulnerability with a CVSS score of 8.1 (HIGH). SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacke...
How severe is CVE-2026-113874?
CVE-2026-113874 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-113874?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.