CVE-2026-113875
CVE-2026-113875 · SmileCDR HAPI FHIR unauthorized read via subscription
This page contains facts from public vulnerability sources. Check the original advisory before updating.
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
CVSS 2.3 · Low · EPSS 0.2%
- Published
- Updated
Affected products and versions
hapi fhir
- Versions
- ≥ 0: Affected (custom)
No fix published