CVE-2026-113874: SmileCDR HAPI FHIR trusted tenant partition override
Published Oct 22, 2026
·Updated
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Affected Software
1 affected component
Smile CDR HAPI FHIR
Event History
Oct 22, 2026
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is a default deployment affected?
Yes. Storage partition entitlement is not enforced by default, so deployments relying on default behavior are affected.
2
What level of access does an attacker need?
The attacker needs authorization for one tenant. No user interaction is required.
3
What can an attacker do after exploiting the issue?
An attacker can use an untrusted bundle body to replace an established partition identity and read from or write to another tenant's partition.