Security researcher Abhinav Agarwal has identified four security vulnerabilities in HAPI FHIR, the widely utilized open-source Java library and server framework implementing the HL7 FHIR standard. These vulnerabilities directly impact Smile Digital Health's Smile CDR clinical data repository and health data platform (specifically demonstrated on HAPI FHIR 8.10.0 / Smile CDR 2026.05.R01).

Because HAPI FHIR is a popular foundational framework integrated into various commercial healthcare products and platforms—impacting more than 30 U.S. payer deployments involving the health records of over 110 million individuals—identifying and patching these risks is critical for healthcare cybersecurity.

Breakdown of the Four Vulnerabilities

CVE-2026-113873 (High Severity — CVSS 8.7 / 7.5)

• Issue: Improper handling of highly compressed data.

• Impact: An unauthenticated attacker could send malicious, heavily compressed payloads designed to exhaust the server heap or crash services upon decompression, leading to unauthenticated service disruption.

CVE-2026-113874 (High Severity — CVSS 8.6 / 8.1)

• Issue: Incorrect authorization and lack of default storage partition enforcement.

• Impact: The engine allowed an untrusted bundle body to overwrite or replace a partition established by a trusted source. Successful exploitation could allow a user authorized for one tenant to read and write data within another tenant’s partition, enabling cross-tenant data access and modification.

CVE-2026-113876 (Medium Severity — CVSS 5.3)

• Issue: Unauthorized read access via conditional create actions.

• Impact: The framework failed to correctly enforce authorization boundaries during conditional create requests. A user holding CREATE privileges without corresponding READ rights could submit a predicate matching an existing resource and inadvertently retrieve the target resource's contents.

CVE-2026-113875 (Low Severity — CVSS 3.1 / 2.3)

• Issue: Missing authorization in REST-hook subscriptions.

• Impact: Users granted subscription-creation permissions could query and read full clinical resources outside their authorized read scope at specific endpoints, including future matching records.

Scope and Mitigation

While HAPI FHIR is maintained by Smile Digital Health, its open-source nature means multiple commercial healthcare and payer systems rely on it, making impact analysis complex. Fortunately, no active exploitation in the wild has been reported at the time of disclosure.

• Smile CDR Fixes: Smile Digital Health has confirmed that fixes are rolling out, with updates targeted to resolve severe heap-exhaustion issues (CVE-2026-113873) in upcoming scheduled patches.

• Mitigating Multi-Tenant Risks: For partition-related authorization flaws (CVE-2026-113874), vendors note that exploitation typically requires an authenticated user who already possesses access to at least one valid partition, mitigating open public-facing threats.

Healthcare organizations, payers, and software developers utilizing HAPI FHIR or Smile CDR are advised to consult their vendor guidelines immediately, audit custom data partitions, and apply the latest security patches to safeguard protected health information (PHI).