Vulnerability

Four unpatched flaws disclosed in HAPI FHIR, the server library behind Smile CDR

MedDevice Cyber Staff · Oct 22 · 3 min read · Via oss-security mailing list disclosure, October 22, 2026

Security researcher Abhinav Agarwal disclosed four vulnerabilities in HAPI FHIR on October 22 through the oss-security mailing list. HAPI FHIR is the open-source Java implementation of HL7's FHIR standard that Smile Digital Health built its commercial Smile CDR platform on top of. Agarwal tested version 8.10.0 and found the same vulnerable code paths in 8.8.2, 8.10.1, and 8.12.1. Smile CDR 2026.05.R01 runs on 8.10.0, though Agarwal did not test the commercial build directly.

The highest-scoring bug, CVE-2026-113874, rates 8.1 on CVSS v3.1 under CWE-863 for incorrect authorization. A caller can attach a Bundle entry extension that overrides the partition header a gateway set, crossing into another tenant's data to read or write records that are not theirs. The flaw needs a deployment running the RequestHeaderPartitionInterceptor setup, but Agarwal reports no fix exists for it yet. A multi-tenant health data platform lives or dies on partition isolation, and this one does not hold it.

CVE-2026-113873, rated 7.5 on CVSS v3.1 under CWE-409, needs no authentication at all. The server decompresses gzip bodies with no size or ratio cap, so a 65,250-byte payload can expand to 64 MiB and exhaust server memory. Agarwal's test produced an OutOfMemoryError. Smile Digital Health has confirmed a fix in its November release, the only one of the four flaws with a committed patch date.

The remaining two score lower but still expose clinical data outside its intended scope. CVE-2026-113876, also CWE-863, rates 4.3 and lets a user with Patient create permission but no read permission pull a complete existing patient record through a matching If-None-Exist conditional create. CVE-2026-113875, CWE-862 at 3.1, applies when REST-hook subscriptions are turned on, letting a subscriber receive full resource data beyond what their own read scope allows. A fix for the conditional-create bug merged upstream in August and is due in HAPI FHIR 9.0.0 on November 19.

HAPI FHIR sits underneath more than one commercial product. Agarwal identified eight other platforms built on the library, and HIPAA Journal reported the exposure could touch more than 30 US payer deployments and data on more than 110 million people. FHIR servers broker the interoperability that claims processing, prior authorization, and clinical data exchange depend on across the device and payer ecosystem. A tenant-isolation failure at that layer does not stay contained to one customer.

Anyone running a FHIR server on this code line should check their build against the affected versions rather than assume a vendor patch covers them. Three of the four bugs have no fix at all, and the fourth is three weeks out.

Are you a representative of Smile Digital Health? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no committed fix yet for three of the four flaws: the cross-tenant partition override (CVE-2026-113874), the unauthenticated gzip decompression bug (CVE-2026-113873, though Smile Digital Health has confirmed a November release will fix it), and the subscription-scope leak (CVE-2026-113875). The conditional-create disclosure (CVE-2026-113876) is merged upstream and due in HAPI FHIR 9.0.0 on November 19. Any deployment running HAPI FHIR 8.8.2 through 8.12.1, including Smile CDR 2026.05.R01, should treat all four as open until confirmed otherwise.

Disable the paths you do not need. Turn off REST-hook subscriptions and the Bundle entry extension that sets partition headers if your deployment does not require them, until a fix lands.
Cap decompression ahead of the server. Put a size and ratio limit on inbound gzip bodies at the gateway so a single request cannot expand past a few megabytes.
Audit cross-tenant access. Review tenant data for reads or writes that crossed partitions, since the flaw has been exploitable with no patch in place.
Track both fix dates. Plan the upgrade to HAPI FHIR 9.0.0 on November 19 and confirm Smile CDR's November release actually contains the gzip fix before relying on it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

HAPI FHIR

PID-31 PID-312 PID-3121 PID-41 PID-411 PID-331 PID-332 PID-2322 PID-311 HL7 or FHIR integration Cloud connectivity User accounts Role-based access Handles patient data Patient or study database Off-the-shelf software

Smile CDR

PID-31 PID-41 PID-411 PID-331 PID-332 PID-2322 PID-311 HL7 or FHIR integration Handles patient data Patient or study database Off-the-shelf software

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-113874 in HAPI FHIR?

CVE-2026-113874 is a cross-tenant partition override in HAPI FHIR, the open-source FHIR server library underneath Smile Digital Health's Smile CDR. It scores 8.1 on CVSS v3.1 and lets a caller override a partition header to read or write another tenant's data, with no fix available as of the October 22 disclosure.

Is there a patch for the HAPI FHIR vulnerabilities?

Only one of the four disclosed flaws has a committed fix date. Smile Digital Health confirmed CVE-2026-113873, the unauthenticated gzip decompression bug, will be fixed in its November release, and the conditional-create flaw CVE-2026-113876 is merged for HAPI FHIR 9.0.0, due November 19. CVE-2026-113874 and CVE-2026-113875 have no fix date yet.

Who found the HAPI FHIR vulnerabilities and which versions are affected?

Security researcher Abhinav Agarwal disclosed the four CVEs on October 22 through the oss-security mailing list. He tested HAPI FHIR 8.10.0 and found the same vulnerable code in versions 8.8.2, 8.10.1, and 8.12.1, the version line Smile CDR 2026.05.R01 is built on.

← Back to Vulnerabilities