Approved changes feed: RSS · Atom
cpe:2.3:a:smilecdr:hapi_fhir:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Smilecdr (0c79f627-b801-5378-87a7-9cb05ebab06d) |
|---|---|
| Product | Hapi Fhir (7dc7554a-2cf6-55cd-a572-33554dd0d2d1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-113873 |
vulnerable | 2026-11-03 10:16:27.936948 |
SmileCDR HAPI FHIR improper data decompression
HIGH (7.5)
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Published: 2026-10-22T17:57:52.475Z
Updated: 2026-11-06T17:44:42.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113876 |
vulnerable | 2026-11-03 10:16:27.497776 |
SmileCDR HAPI FHIR unauthorized read
MEDIUM (4.3)
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
Published: 2026-10-22T18:00:15.049Z
Updated: 2026-10-26T12:57:43.477Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113874 |
vulnerable | 2026-11-03 10:16:27.349791 |
SmileCDR HAPI FHIR trusted tenant partition override
HIGH (8.1)
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Published: 2026-10-22T17:58:56.709Z
Updated: 2026-11-06T17:44:26.448Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113875 |
vulnerable | 2026-11-03 10:16:27.179735 |
SmileCDR HAPI FHIR unauthorized read via subscription
LOW (3.1)
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
Published: 2026-10-22T18:00:01.244Z
Updated: 2026-11-06T17:44:11.886Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.