CVE-2026-113874: SmileCDR HAPI FHIR trusted tenant partition override

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-863

Description

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

Affected products

SmileCDR HAPI FHIR: all versions

References

https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json
https://www.cve.org/CVERecord?id=CVE-2026-113874

Get alerted when CVE-2026-113874 or the next vulnerability affects your stack