CVE-2026-113875 in HAPI FHIR
Summary
by MITRE • 10/23/2026
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability in question represents a critical authorization bypass within the SmileCDR platform, specifically affecting instances where HAPI FHIR server configurations include enabled REST-hook subscriptions. This flaw stems from an improper implementation of Access Control Lists (ACL) or role-based permissions when processing subscription hooks. In standard FHIR operations, access to resources is strictly governed by the authenticated user's privileges and the configured security policies. However, the mechanism responsible for triggering webhooks upon resource changes fails to enforce these same restrictions during the payload generation phase. Consequently, a malicious actor who possesses only minimal permissions sufficient to create subscriptions can exploit this logic gap to extract sensitive patient data or other protected health information that they are explicitly denied access to through normal API endpoints.
From a technical perspective, the issue lies in how the server constructs and transmits notification payloads for REST-hook events. When a subscription is triggered by a change in a resource, such as an update or creation event, the server generates a webhook payload containing details about that resource. The vulnerability arises because this generation process does not re-evaluate the current user's permissions against the target resource before including it in the notification. Instead, it appears to rely on internal system privileges or fails to filter data based on the subscriber's identity. This allows an attacker with subscription-creation rights to subscribe to changes on high-value resources and subsequently receive their contents via HTTP POST requests directed at a controlled endpoint under their command.
The operational impact of this vulnerability is severe, particularly in healthcare environments where compliance with regulations such as HIPAA or GDPR is mandatory. By leveraging this flaw, an unauthorized user can perform data exfiltration without triggering typical audit alerts associated with direct resource queries. This bypasses standard security monitoring tools that track explicit read operations on protected health information (PHI). The attacker gains the ability to silently harvest sensitive medical records, diagnostic results, and personal identifiers over time by subscribing to relevant resources. This constitutes a significant breach of confidentiality and integrity, potentially leading to regulatory fines, legal liability, and loss of trust among patients and partners.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting the failure to enforce proper restrictions on authenticated users within an application's security architecture. Furthermore, it maps directly to MITRE ATT&CK technique T1530, Data from Cloud Storage Object or Database, as well as T1078, Valid Accounts, since the attacker utilizes legitimate but insufficiently privileged credentials to achieve unauthorized data access. The exploitation vector is classified under Remote Code Execution principles in terms of impact, though technically it is a remote information disclosure via API abuse.
Mitigation strategies must focus on enforcing strict permission checks at every stage of resource interaction within the SmileCDR ecosystem. Administrators should ensure that subscription hooks are configured to validate user permissions against the target resources before generating payloads for webhooks. This involves implementing context-aware access control logic where the system verifies if the subscriber has read access to the specific resource instance being modified. Additionally, organizations should apply vendor-provided patches or updates as soon as they become available, which typically address these logical flaws in permission handling. In the interim, limiting subscription-creation permissions to only those users who absolutely require them can reduce the attack surface. Regular auditing of webhook endpoints and monitoring for unusual outbound traffic patterns may also help detect exploitation attempts early.