HAPI FHIR flaws allow cross-tenant reads, writes and gzip exhaustion
CISA issued four CVEs and CSAF advisory VA-26-294-01; a researcher reproduced all four on HAPI FHIR 8.10.0.
62
CVE-2026-113874
Cross-tenant partition override in SmileCDR HAPI FHIR
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SmileCDR HAPI FHIR lets an untrusted bundle body replace a partition identity that a trusted source already set, and does not enforce storage partition entitlement by default. An attacker who is already authorized for one tenant can send that bundle over the network, with no user interaction, and read from or write to another tenant's partition.
What to do: Apply SmileCDR's update for CVE-2026-113874. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| SmileCDR HAPI FHIR | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
- Weakness
- CWE-863
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X