Four HAPI FHIR flaws allow data leakage in Smile CDR
A researcher identified four vulnerabilities in HAPI FHIR 8.10.0, the open-source component used by Smile Digital Health's Smile CDR 2026.05.R01. The flaws allow cross-tenant access and modification, patient record disclosure, clinical data leakage, and unauthenticated service disruption; there is no known exploitation and no fix announced. Organizations using Smile CDR or products embedding HAPI FHIR should confirm versions and fixes with vendors.
What happened
A security researcher identified four vulnerabilities in HAPI FHIR, a free open-source component used by Smile Digital Health's Smile CDR health data platform. Per the researcher, the flaws allow cross-tenant data access and modification, patient record disclosure, and unauthenticated service disruption. There is no known exploitation and no fix announced.
Why it matters
HAPI FHIR ships inside many healthcare products; the researcher identified eight other commercial products that use it, and determining which are at risk is hard. The risk is exposure of clinical patient data, which is sensitive and covered by privacy rules. There is also risk of health data services being disrupted by an unauthenticated attacker.
What to do
Inventory which systems use Smile CDR or products embedding HAPI FHIR and confirm the version with each vendor. Ask vendors about a fix and, until one exists, restrict internet exposure of the servers.
For the technical team
- Affected
- Smile Digital Health (mantém o projeto HAPI FHIR) HAPI FHIR / Smile CDR · HAPI FHIR 8.10.0 (version used in the demonstration), used by Smile CDR 2026.05.R01. HAPI FHIR is used in many healthcare products; the researcher cited eight other commercial products incorporating it.
- Exploitation
- Demonstrated by researcher Abhinav Agarwal against HAPI FHIR 8.10.0 on Smile CDR 2026.05.R01. Per HIPAA Journal, no known exploitation at the time of the announcement.
- Fix
- No fix disclosed in the sources.
- Vector
- CVE-2026-113873: improper handling of highly compressed data; an unauthenticated attacker sends compressed payloads that can exhaust the server heap or crash services when decompressed. Per researcher Abhinav Agarwal, the four flaws together allow cross-tenant data access and modification, unauthorized patient record disclosure, and clinical data leakage. The source names CVE-2026-113874 with no description; the other two CVE identifiers do not appear in the text.
- More details
- CVE-2026-113873: high severity; CVSS v3.1 base score 7.5 and v4.0 base score 8.7. HAPI FHIR is an open-source Java library and server framework implementing the HL7 FHIR standard; the project is maintained by Smile Digital Health. Disclosure logged on 2026-10-26 per the timeline.
Timeline
Disclosure points to four HAPI FHIR flaws affecting Smile CDR.
Sources 1 source
- Multiple Vulnerabilities Identified in Component Used by Smile Digital Health’s Smile CDR HIPAA Journal
