Four flaws in HAPI FHIR, the open-source Java library that implements the HL7 FHIR standard, reach into Smile Digital Health’s Smile CDR clinical data repository and health data platform. Researcher Abhinav Agarwal demonstrated all four against HAPI FHIR 8.10.0, the engine behind Smile CDR 2026.05.R01.
The most serious pair allows cross-tenant data access. CVE-2026-113874, an incorrect authorization flaw scoring 8.1, lets an untrusted bundle body replace a partition created by a trusted source, so a user cleared for one tenant can read and write another tenant’s records. CVE-2026-113873, scoring 7.5, involves improper handling of highly compressed data; unauthenticated compressed payloads can exhaust the server heap or crash services.
Two more round out the set. CVE-2026-113876 scores 5.3 for unauthorized read access through conditional create, where a user with create but not read permission can retrieve the contents of an existing resource. CVE-2026-113875 scores 3.1 and affects servers with REST-hook subscriptions, letting a subscription creator pull clinical resources beyond their read scope.
Payers carry the weight
HAPI FHIR is free and embedded in many healthcare products, and Agarwal counted eight other commercial platforms built on it. The flaws could touch more than 30 US payer deployments covering the health data of over 110 million people. Smile Digital Health says the compression flaw is fixed in its November release and that the partition flaw needs an authenticated user already authorized for one partition, limiting exploitation. No attacks are known.
Providers cannot patch what they cannot inventory. Ask every FHIR-facing vendor whether they ship HAPI FHIR and which version.
