Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR
Four vulnerabilities have been identified in HAPI FHIR, the open-source Java library and server framework that implements the HL7 FHIR standard, that affect Smile Digital Health’s Smile CDR clinical data repository and health data platform. The four vulnerabilities were identified by security researcher Abhinav Agarwal, who demonstrated that they can be exploited against HAPI FHIR 8.10.0, used by Smile CDR 2026.05.R01. According to Agarwal, exploitation of the vulnerabilities can allow cross-tenant data access and modification, unauthorized patient record disclosure, clinical data leakage, and unauthenticated service disruption.
HAPI FHIR is a widely used open source software component and is not exclusively used by Smile Digital Health’s CDR platform; however, Smile Digital Health maintains the HAPI FHIR project. The component is free to use and has been incorporated into many healthcare products, and for healthcare providers, determining which are at risk could be challenging. According to Agarwal, he identified eight other commercial products that use HAPI FHIR. At the time of the announcement, there has been no known exploitation of the flaws.
The vulnerabilities are:
- CVE-2026-113873: Improper handling of highly compressed data – High severity. An unauthenticated attacker could send compressed payloads that could exhaust the server heap or crash services when decompressed. The vulnerability has a CVSS v3.1 base score of 7.5 and a v4.0 base score of 8.7.
- CVE-2026-113874: Incorrect authorization – High severity. The SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition previously established by a trusted source. Storage partition entitlement is not enforced by default. Successful exploitation of the vulnerability can allow an attacker authorized for one tenant to read and write data in another tenant’s partition. The vulnerability has a CVSS v3.1 base score of 8.1 and a CVSS v4.0 base score of 8.6.
- CVE-2026-113876: Unauthorized read access – Medium severity. Smile CDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE, but not READ, permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource’s contents. The vulnerability has a CVSS v3.1 base score of 5.3 and a CVSS v4.0 base score of 5.3.
- CVE-2026-113875: Missing authorization – Low severity. The vulnerability affects the Smile CDR HAPI FHIR server with REST-hook subscriptions enabled. If a user is granted subscription-creation permissions, they could query and read full clinical resources outside their authorized read scope at a specified endpoint, including future matching records. The vulnerability has a CVSS v3.1 base score of 3.1, and a CVSS v4.0 base score of 2.3.
The flaws in the HAPI FHIR open source engine utilized by the Smile CDR health data platform could impact more than 30 US payer deployments that involve the health data of more than 110 million individuals in the United States. Smile Digital Health has confirmed that CVE-2026-113873 will be fixed in its November release, and CVE-2026-113874 can only be exploited by an authenticated user who is authorized to access at least one partition, so the potential for exploitation is limited.
