Key points
- The flaw allows an attacker authorized for one tenant to read or write to another tenant's partition.
- SmileCDR HAPI FHIR versions before the unspecified fixed version are affected.
- The vulnerability carries a CVSS score of 8.1, rated as high severity.
SmileCDR HAPI FHIR software contains a security flaw that allows unauthorized access to tenant data. The issue affects versions before the unspecified fixed release. An attacker who has legitimate access to one tenant's account can bypass partition controls. This allows them to read or write data belonging to other tenants. The flaw exists because the system does not enforce storage partition entitlements by default.
In plain English
The software relies on partition identities to keep tenant data separate. An untrusted bundle body can replace a partition identity that a trusted source established. This means the system accepts incorrect identity information without verifying its origin. Consequently, the boundary between different tenants becomes permeable. An attacker can use this gap to access data they should not see. The system fails to check if the user has permission for the target partition.
The background
The National Vulnerability Database lists this issue as CVE-2026-113874. It assigns a Common Vulnerability Scoring System rating of 8.1. This places the severity in the high range. The weakness is classified under CWE-863. The description notes that the flaw allows an untrusted source to alter partition identity. This breaks the intended isolation between different users or organizations using the same instance.
What changes now
Users must identify which version of SmileCDR HAPI FHIR they are running. If the version is before the unspecified fixed release, they are exposed to this risk. No confirmed fix has been identified in the source material. Users should verify their current installation against the affected range. Upgrading to a patched version, if available, removes the vulnerability. Delaying action leaves the system open to cross-tenant data breaches.
Who needs to act first
Teams should prioritize updating systems that expose data to multiple tenants. Verify the current software version against the vulnerability details. Schedule the update during a maintenance window to minimize disruption. Test the upgrade in a non-production environment first. Ensure backups of current configurations exist before making changes. Monitor system logs for unusual activity during the transition. Communicate the maintenance plan to stakeholders to manage expectations.
What to do and how to stay safe: SmileCDR HAPI FHIR
- Verify your SmileCDR HAPI FHIR version to see if it falls within the affected range.
- Check for vendor updates to address the security gap.
- Review access logs for any unauthorized cross-tenant data access attempts.
- Monitor system behavior after any changes to ensure stability and security.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of SmileCDR HAPI FHIR are affected?
Versions before the unspecified fixed release are affected by CVE-2026-113874.
What is the severity of this vulnerability?
The flaw has a CVSS score of 8.1, which is rated as high severity.
Can an attacker access other tenants' data?
Yes, an attacker authorized for one tenant can read from or write to another tenant's partition.
