SmileCDR HAPI FHIR Flaw Enables Cross-Tenant Data Access via Partition Identity

SmileCDR HAPI FHIR contains a high-severity vulnerability that permits authorized users to access or modify data within other tenants' partitions, according to the National Vulnerability Database. The issue stems from the application’s handling of bundle bodies and partition identity, which fails to enforce storage entitlements by default. This misconfiguration allows an attacker with valid credentials for one tenant to traverse boundaries and interact with data they should not see.

The risk

The vulnerability, tracked as CVE-2026-113874, carries a CVSS score of 8.1, classified as high severity. The underlying weakness is identified as CWE-863. According to the NVD record, the flaw allows an untrusted bundle body to replace a partition identity that was previously established by a trusted source. This mechanism failure means that the system does not correctly validate the origin or scope of the data being processed, leading to unauthorized cross-tenant access.

Who is exposed

Any organization using SmileCDR HAPI FHIR versions before the unspecified fixed version is exposed to this risk. The National Vulnerability Database indicates that the vulnerability affects SmileCDR HAPI FHIR before the version denoted by an asterisk. Because storage partition entitlement is not enforced by default, environments that rely on this default configuration are particularly vulnerable. Attackers need only be authorized for a single tenant to exploit the flaw and access other tenants' data.

Cost and compliance

The source material does not detail specific financial costs or regulatory compliance impacts associated with this vulnerability. The National Vulnerability Database record focuses on the technical description of the flaw and its severity rating. It states that an attacker can read from or write to another tenant's partition. No information is provided regarding fines, legal liability, or specific compliance frameworks that may be violated by this cross-tenant data access.

What to watch

Security teams should verify if their SmileCDR HAPI FHIR instances are running versions before the unspecified fixed version. Monitoring for unusual data access patterns across tenant boundaries is essential. Organizations should review their current storage partition entitlement settings to ensure they are not relying on the insecure default configuration. Immediate action is required to prevent unauthorized data exposure between tenants.

Signals worth monitoring

Teams usually detect this type of activity by looking for data access requests that originate from a user context but target resources outside their assigned partition. Check whether application logs show successful write or read operations for bundle bodies that reference partition identities different from the user’s authorized tenant. Look for alerts indicating that a trusted source’s partition identity was overwritten or replaced by an untrusted input.

Investigate any sudden spikes in cross-tenant API calls or data transfers that do not align with normal business processes. Review authentication logs to see if a single authorized session is accessing multiple distinct tenant datasets. Verify that storage entitlement checks are being triggered and recorded for every data ingestion event. If logs show that partition identity validation was skipped or failed silently, treat this as a potential compromise. Ensure that monitoring tools are configured to flag any attempt to modify partition metadata by non-administrative users.

What to do and how to stay safe: SmileCDR

• Audit current SmileCDR HAPI FHIR installations to confirm they are not running vulnerable versions.
• Review storage partition entitlement settings to ensure they are explicitly enforced rather than left at default.
• Monitor application logs for unauthorized cross-tenant data access or partition identity changes.
• Restrict user permissions to the minimum necessary scope to limit the impact of any potential exploitation.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-113874?

The National Vulnerability Database rates the severity of CVE-2026-113874 as high, with a CVSS score of 8.1.

Which versions of SmileCDR HAPI FHIR are affected?

According to the NVD record, all versions of SmileCDR HAPI FHIR before the version denoted by an asterisk are affected.

How can an attacker exploit this vulnerability?

An attacker authorized for one tenant can use an untrusted bundle body to replace partition identity and access another tenant's data.