HAPI FHIR flaws allow cross-tenant reads, writes and gzip exhaustion
Original title: CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion
CISA issued four CVEs and CSAF advisory VA-26-294-01; a researcher reproduced all four on HAPI FHIR 8.10.0.
CISA published CVE-2026-113873, CVE-2026-113874, CVE-2026-113875 and CVE-2026-113876, plus CSAF advisory VA-26-294-01, for HAPI FHIR, an open-source Java HL7 FHIR implementation. The issues were coordinated as VINCE case VU#394579. Abhinav Agarwal says he reproduced all four on upstream 8.10.0, commit 96ac50f89455, with synthetic data. A caller authorized for one tenant can read another tenant's data or create data in another tenant's partition.
Unconfirmed: The posted affected-version range is cut off; only reproduction on 8.10.0 is stated.
- The four issues cover partition override, authorization bypasses and gzip heap exhaustion.
- Reproduction used upstream HAPI FHIR 8.10.0, commit 96ac50f89455.
- The advisory identifier given is VA-26-294-01.
- The snippet cuts off before the affected-version list.
Impact: Cross-tenant FHIR data read or write
| Product | Affected |
|---|---|
| HAPI FHIR | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-113873+2 related CVEs | Unauthenticated heap exhaustion in SmileCDR HAPI FHIR | 8.7 group max | — | ||
| CVE-2026-113875 | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read… | 2.3 | — |
From the original article
Posted by Abhinav Agarwal on Oct 22 CISA has published four CVE records and CSAF advisory VA-26-294-01 for vulnerabilities in HAPI FHIR, an open-source Java implementation of HL7 FHIR. They were coordinated under VINCE case VU#394579. I reproduced all four on upstream HAPI FHIR 8.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.