HAPI FHIR
Advisory ansehen veröffentlicht 2026-10-22
SmileCDR HAPI FHIR contains multiple vulnerabilities. In the worst case, a user could read or write content in a tenant partition that they should not have access to, or an unauthenticated user could trigger a denial-of-service.
01
beschreibt (4)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-113876US | —OT erhöht | — | ||
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predic… | ||||
| CVE-2026-113875US | —OT erhöht | — | ||
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they… | ||||
| CVE-2026-113874US | —OT erhöht | — | ||
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by… | ||||
| CVE-2026-113873US | — | — | ||
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain servi… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (4)
- Kein Fix verfügbarHAPI FHIR
No fix available.
- Kein Fix verfügbarHAPI FHIR
No fix available.
- Kein Fix verfügbarHAPI FHIR
No fix available.
- BehobenHAPI FHIR
Fixed around September 2026.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan