Four HAPI FHIR vulnerabilities in Smile Digital Health's Smile CDR enable cross-tenant access and DoS
Four vulnerabilities were disclosed in HAPI FHIR, the open-source Java library and server framework implementing the HL7 FHIR standard, affecting Smile Digital Health's Smile CDR clinical data repository. Researcher Abhinav Agarwal demonstrated exploitation against HAPI FHIR 8.10.0, used by Smile CDR 2026.05.R01. Successful exploitation could allow cross-tenant data access and modification, unauthorized patient record disclosure, clinical data leakage, and unauthenticated service disruption. The flaws could affect more than 30 US payer deployments covering the health data of over 110 million individuals. No exploitation in the wild is known at the time of disclosure.
Entenda a falha
A vulnerabilidade
Four flaws in HAPI FHIR 8.10.0, the open-source Java FHIR library and server framework used by Smile Digital Health's Smile CDR 2026.05.R01. The most severe, CVE-2026-113874 (High, CVSS 3.1 8.1), is an incorrect authorization flaw: an attacker authorized for one tenant can read and write data in another tenant's partition. CVE-2026-113873 (High, 7.5) lets an unauthenticated attacker send highly compressed payloads that exhaust the heap or crash services. CVE-2026-113876 (Medium, 5.3) lets a user with CREATE but not READ permission read an existing resource through a conditional create. CVE-2026-113875 (Low, 3.1) affects servers with REST-hook subscriptions enabled. Only a fix for CVE-2026-113873, in the November release, is confirmed; the articles give no other fixed versions.
Como funciona
For CVE-2026-113873, the server receives a compressed payload and decompresses it without limiting the result, so memory is consumed until the heap is exhausted or services crash. For CVE-2026-113874, a request carries a bundle whose body names a partition; the server lets that untrusted value replace the partition set earlier by a trusted source, and since storage partition entitlement is not enforced by default, the request runs against another tenant's data. For CVE-2026-113876, a conditional create is evaluated against existing resources and, when its predicate matches, the matched resource is returned without a READ permission check. For CVE-2026-113875, a user allowed to create subscriptions gets full matching clinical resources, including future ones, delivered to a specified endpoint outside their read scope.
Por que é vulnerável
The common theme is missing or misplaced checks. Decompression has no effective guard against highly compressed input. Partition selection trusts a value from an untrusted bundle body over the trusted one, and partition entitlement is off by default. Conditional create and REST-hook subscription creation do not verify that the caller has read rights over the data they end up exposing. The articles do not explain why these went unnoticed or detail the fix, apart from Smile's statement that CVE-2026-113873 will be fixed in the November release.
Como foi descoberta
Security researcher Abhinav Agarwal identified the four flaws and demonstrated exploitation against HAPI FHIR 8.10.0 as used by Smile CDR 2026.05.R01. He also says he found eight other commercial products that use HAPI FHIR. The articles do not say how or when he reported them. No exploitation in the wild is known at disclosure. Smile Digital Health confirmed the November fix for CVE-2026-113873 and said CVE-2026-113874 requires an authenticated user authorized for at least one partition.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 11:18.
Detalhes técnicos
- CVE-2026-113873 (High, CVSS v3.1 7.5 / v4.0 8.7): improper handling of highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust the server heap or crash services on decompression.
- CVE-2026-113874 (High, CVSS v3.1 8.1 / v4.0 8.6): incorrect authorization. An untrusted bundle body can replace a partition established by a trusted source, and storage partition entitlement is not enforced by default. An attacker authorized for one tenant can read and write data in another tenant's partition.
- CVE-2026-113876 (Medium, CVSS 5.3 / 5.3): unauthorized read access. Authorization is not correctly checked for conditional create actions. A user with CREATE but not READ permission can submit a conditional create whose predicate matches an existing resource and receive its contents.
- CVE-2026-113875 (Low, CVSS v3.1 3.1 / v4.0 2.3): missing authorization when REST-hook subscriptions are enabled. A user with subscription-creation permission can read full clinical resources outside their read scope, including future matching records.
HAPI FHIR is maintained by Smile Digital Health but is embedded in many healthcare products. Agarwal identified eight other commercial products that use it, which makes exposure hard for providers to assess.
Remediação
Smile Digital Health has confirmed that CVE-2026-113873 will be fixed in its November release. It also states that CVE-2026-113874 is exploitable only by an authenticated user authorized to access at least one partition, which limits exploitation potential. The article gives no other patch details.
Linha do tempo
-
Four HAPI FHIR vulnerabilities in Smile Digital Health's Smile CDR enable cross-tenant access and DoS
ler a análise desta fonte ocultar
Four vulnerabilities were disclosed in HAPI FHIR, the open-source Java library and server framework implementing the HL7 FHIR standard, affecting Smile Digital Health's Smile CDR clinical data repository. Researcher Abhinav Agarwal demonstrated exploitation against HAPI FHIR 8.10.0, used by Smile CDR 2026.05.R01. Successful exploitation could allow cross-tenant data access and modification, unauthorized patient record disclosure, clinical data leakage, and unauthenticated service disruption. The flaws could affect more than 30 US payer deployments covering the health data of over 110 million individuals. No exploitation in the wild is known at the time of disclosure.
Technical Details
- CVE-2026-113873 (High, CVSS v3.1 7.5 / v4.0 8.7): improper handling of highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust the server heap or crash services on decompression.
- CVE-2026-113874 (High, CVSS v3.1 8.1 / v4.0 8.6): incorrect authorization. An untrusted bundle body can replace a partition established by a trusted source, and storage partition entitlement is not enforced by default. An attacker authorized for one tenant can read and write data in another tenant's partition.
- CVE-2026-113876 (Medium, CVSS 5.3 / 5.3): unauthorized read access. Authorization is not correctly checked for conditional create actions. A user with CREATE but not READ permission can submit a conditional create whose predicate matches an existing resource and receive its contents.
- CVE-2026-113875 (Low, CVSS v3.1 3.1 / v4.0 2.3): missing authorization when REST-hook subscriptions are enabled. A user with subscription-creation permission can read full clinical resources outside their read scope, including future matching records.
HAPI FHIR is maintained by Smile Digital Health but is embedded in many healthcare products. Agarwal identified eight other commercial products that use it, which makes exposure hard for providers to assess.
Remediation
Smile Digital Health has confirmed that CVE-2026-113873 will be fixed in its November release. It also states that CVE-2026-113874 is exploitable only by an authenticated user authorized to access at least one partition, which limits exploitation potential. The article gives no other patch details.