PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113875 SmileCDR CVE debrief

A CVE record describes a low-severity vulnerability in SmileCDR HAPI FHIR servers with REST-hook subscriptions enabled. An attacker with subscription-creation permissions may query and read unauthorized resources. This vulnerability affects healthcare organizations and FHIR service administrators, who should assess exposure and review access controls to prevent unauthorized resource access. The CVE Program and NVD provide official records, while SmileCDR and third-party sources offer additional context.

Vendor
SmileCDR
Product
HAPI FHIR
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-26
Advisory published
2026-10-22
Advisory updated
2026-10-26

Who should care

Healthcare organizations and FHIR service administrators should assess exposure and review access controls to prevent unauthorized resource access. This vulnerability affects healthcare organizations and FHIR service administrators, who should verify exposure, review access controls, and monitor logs to prevent unauthorized resource access.

Why it matters

CVE-2026-113875 is a low-severity vulnerability in SmileCDR HAPI FHIR servers. Healthcare organizations and FHIR service administrators should verify exposure, review access controls, and monitor logs to prevent unauthorized resource access.

  • Verify subscription permissions to prevent unauthorized resource access.
  • Review access controls to ensure proper authorization.
  • Monitor FHIR service logs for suspicious activity.

Technical summary

CVE-2026-113875 is a low-severity vulnerability in SmileCDR HAPI FHIR servers with REST-hook subscriptions enabled. An attacker with subscription-creation permissions may query and read resources they are not authorized to access. This vulnerability affects healthcare organizations and FHIR service administrators, who should assess exposure and review access controls to prevent unauthorized resource access. The vulnerability has a low severity score of 3.1 and is classified as LOW. There is no known ransomware campaign use.

Defensive priority

Healthcare and FHIR service administrators should verify exposure and review access controls.

Recommended defensive actions

  • Verify subscription permissions and access controls on SmileCDR HAPI FHIR servers.
  • Review and restrict subscription-creation permissions.
  • Monitor FHIR service logs for unauthorized resource queries.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program and NVD provide official records. SmileCDR and third-party sources offer additional context. Evidence is limited, and defenders should verify exposure and review access controls. The vulnerability has a low severity score of 3.1 and is classified as LOW. There is no known ransomware campaign use. Healthcare organizations and FHIR service administrators should verify exposure and review access controls.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113875 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113875

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113875 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113875

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • SmileCDR HAPI FHIR unauthorized read via subscription

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113875.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.