SmileCDR HAPI FHIR: Cross-tenant partition override via transaction bundle
Summary
HAPI FHIR, the Java library used by Smile CDR, lets a transaction or batch bundle entry replace the tenant partition set by a trusted gateway. The storage partition entitlement check is not enforced by default. An attacker with valid access to one tenant can read from and create resources in another tenant's partition. The researcher demonstrated reads and creations only; changing or deleting existing foreign resources was not tested.
Affected
- HAPI FHIR, all versions per the CVE record (affected 0 to < *; default unknown)
- Tested on upstream HAPI FHIR 8.10.0 (commit 96ac50f89455); the same code path was found in 8.8.2, 8.10.1 and 8.12.1
- The partition extension first appeared in 8.2.0
- Smile CDR 2026.05.R01 is based on HAPI FHIR 8.10.0
- Multi-tenant deployments with partitioning enabled are the relevant case
Fixed in
Unknown. No fix was available at publication according to CISA and the oss-security disclosure. Smile has not published a fixed version.
Workaround
Unknown. No vendor-confirmed workaround has been published.
- Check whether storage partition entitlement enforcement is enabled in your deployment (the vendor has not named the setting; ask Smile for it)
Exploitation
- Not known to be exploited at the time of announcement
- A detailed public write-up by the researcher exists
- VulDB reports that no exploit is available; this has not been independently confirmed
Our recommendation
- Confirm whether your product embeds HAPI FHIR or Smile CDR, and whether it runs in multi-tenant mode
- Ask your vendor for a fixed version, the entitlement configuration setting and a patch date
- Limit partition access to users who need it and review those accounts
- Restrict network access to the FHIR endpoint
- Log and review requests that touch more than one partition
- Note: CVSS 4.0 score 8.6 (NVD record); CISA CVSS 3.1 score 8.1
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-113874 www.cve.org
- Researcher write-up (Abhinav Agarwal) abhinavagarwal07.github.io
- CISA CSAF VA-26-294-01 raw.githubusercontent.com
- oss-security disclosure seclists.org
- HIPAA Journal: HAPI FHIR vulnerabilities Smile CDR www.hipaajournal.com
- HOL Guard CVE-2026-113874 hol.org
- VulDB 425355 vuldb.com
- Strix CVE-2026-113874 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:15.
Original description (NVD)
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.