CVE-2026-113876: SmileCDR HAPI FHIR unauthorized read
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed where a user has CREATE permission but does not have READ permission for the relevant resources. The issue is reachable over the network and does not require user interaction.
What does an attacker need to exploit it?
An attacker needs an authenticated account with CREATE permission. They can submit a conditional create with a predicate that matches an existing resource.
What can be disclosed through exploitation?
If the conditional-create predicate matches an existing resource, the response can reveal that target resource's contents. The provided information indicates confidentiality impact only; no integrity or availability impact is specified.