Live › vulnerability › CVE-2026-113875
Go to dashboardOn a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted permission to create subscriptions can query resources they are not otherwise allowed to access. The attacker gets read access to FHIR data outside their normal permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SmileCDR with the HAPI FHIR server and REST-hook subscriptions turned on, where some users hold subscription-creation rights. Servers with REST-hook subscriptions disabled, or where no non-admin user can create subscriptions, are not exposed according to the description. The sources do not name specific versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
This page as .md · .json · in your agent: get_signal("CVE-2026-113875")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.