SmileCDR HAPI FHIR CVE-2026-113875

Exploitation requires two concrete prerequisites stated in the description: the SmileCDR HAPI FHIR server must have REST-hook subscriptions enabled, and the attacker must be an authenticated user who has specifically been granted subscription-creation permissions. These are the limiting factors - the actor must already be a trusted, provisioned internal user, the subscription feature must be turned on (not guaranteed to be default), and the CVSS AC:H indicates additional non-trivial conditions must be met to successfully reach resources outside the user's authorization. Impact is confined to unauthorized read access (confidentiality); no data modification or availability effect is indicated.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable but authenticated (PR:L) weakness with high attack complexity (AC:H) and only limited confidentiality impact (C:L; no integrity or availability impact). The vuln.today decision label is 'monitor,' the weakest urgency tier, which aligns with the low CVSS. No EPSS score, no CISA KEV listing, and no SSVC breakdown (exploitation/automatable/technical-impact) were supplied in the input, so there is no quantitative exploitation-probability signal to weigh. No public exploit or PoC reference is present - the only references are the CVE.org record and a CISA CSAF advisory JSON, both of which are advisory sources, not exploit code. The realistic risk is a privilege/authorization boundary bypass (CWE-862, missing authorization) usable only by an already-trusted internal user who holds subscription-creation rights, to read FHIR resources beyond their normal permission set. In a healthcare/FHIR context the data exposed could be sensitive (PHI), which raises the consequence of the limited confidentiality impact, but the prerequisites and AC:H keep real-world exploitability narrow.

An authenticated SmileCDR HAPI FHIR user who has been granted subscription-creation permissions creates a REST-hook subscription whose criteria target FHIR resources they are not otherwise authorized to read; the subscription delivery mechanism then returns or exposes those out-of-scope resources to them. No public exploit code is identified in the provided sources, and the attack requires the REST-hook subscription feature to be enabled and the actor to already hold subscription-creation rights.