CVE-2026-113875: SmileCDR HAPI FHIR unauthorized read via subscription
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SmileCDR HAPI FHIR deployments with REST-hook subscriptions enabled are exposed when users have permission to create subscriptions. The issue can allow those users to read resources beyond their normal access permissions.
What access does an attacker need?
An attacker needs an account or other access level that grants subscription-creation permissions. No user interaction is required.
Are default deployments affected?
The available information identifies REST-hook subscriptions being enabled and subscription-creation permission being granted as the relevant conditions. It does not state whether these are enabled or granted by default.