Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-113875

SmileCDR HAPI FHIR unauthorized read via subscription

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Smilecdr
Products
Hapi Fhir
CVE-2026-113874

SmileCDR HAPI FHIR trusted tenant partition override

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Smilecdr
Products
Hapi Fhir
CVE-2026-113873

SmileCDR HAPI FHIR improper data decompression

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Smilecdr
Products
Hapi Fhir
CVE-2026-113876

SmileCDR HAPI FHIR unauthorized read

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Smilecdr
Products
Hapi Fhir