HAPI FHIR vulnerabilities

2 known vulnerabilities in HAPI FHIR from SmileCDR. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  HAPI FHIR: Incorrect Authorization

  CVE-2026-113874Oct 22, 2026SmileCDR

  SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to anothe

• 7.5 High severity

  HAPI FHIR: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-113873Oct 22, 2026SmileCDR

  SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.