CVE-2026-113876
CVE-2026-113876 · SmileCDR HAPI FHIR unauthorized read
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
CVSS 5.3 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
hapi fhir
- Versions
- ≥ 0, < September 2026: Affected (custom)
- September 2026: Not affected
No fix published