SmileCDR HAPI FHIR CVE-2026-113874

Exploitation requires (1) a multi-tenant/partitioned SmileCDR HAPI FHIR deployment, (2) valid authenticated access to at least one tenant (PR:L), and (3) the default configuration in which storage partition entitlement is NOT enforced. The specific trigger is an untrusted FHIR bundle body that overrides a partition identity previously set by a trusted source. LIMITING FACTORS: the attacker must already possess tenant credentials (not pre-auth), and deployments that have explicitly enabled partition entitlement enforcement are not exposed in the same way; single-tenant deployments have no cross-tenant boundary to cross. No end-user interaction is required (UI:N).

This is a genuine priority rather than an inflated high-CVSS issue, though not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) describes a network-reachable, low-complexity flaw requiring only low-level privileges (PR:L), meaning any legitimately authenticated tenant user can cross into other tenants' partitions with high confidentiality and integrity impact and no availability impact. The vuln.today decision label is 'this_week' and it was reported through CISA coordinated disclosure (cisa-cg), which raises its credibility as a real coordinated-disclosure finding. However, several key signals are MISSING: there is no EPSS exploitation-probability score in the input, the CVE is NOT listed in CISA KEV, and no PoC or exploit reference is provided - so there is no evidence of active exploitation or public exploit code. The 'Authentication Bypass' tag is slightly imprecise: this is an authorization/tenant-isolation failure (CWE-863) by an already-authenticated user, not a pre-auth bypass, and the PR:L in the vector confirms authentication is required. The most important aggravating factor is that entitlement is 'not enforced by default,' so default deployments are exposed. Net: elevated priority driven by default-vulnerable multi-tenant isolation in a healthcare data product, tempered by the absence of EPSS/KEV/PoC signals indicating no confirmed in-the-wild activity yet.

An attacker holds valid credentials for Tenant A in a multi-tenant SmileCDR/HAPI FHIR deployment running the default configuration. They submit a crafted FHIR bundle whose body asserts a partition identity belonging to Tenant B; because storage partition entitlement is not enforced by default, the server honors the untrusted partition claim and lets the attacker read or write Tenant B's records. No public exploit code is identified at time of analysis, and the precise bundle-crafting trigger is only described at a high level in the available sources.