CVE-2026-113874: CWE-863 Incorrect Authorization in SmileCDR HAPI FHIR

SmileCDR HAPI FHIR suffers from an incorrect authorization vulnerability (CWE-863) where an untrusted bundle body can replace a partition identity previously established by a trusted source. The product does not enforce storage partition entitlement by default, enabling an attacker with authorization for one tenant to read from or write to another tenant's partition. This flaw leads to unauthorized cross-tenant data access and modification.

An attacker authorized for one tenant can read or write data in another tenant's partition, resulting in unauthorized data disclosure and data integrity compromise. The vulnerability does not impact availability. The CVSS 3.1 score is 8.1 (high) with network attack vector, low attack complexity, privileges required, no user interaction, and high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since SmileCDR HAPI FHIR does not enforce storage partition entitlement by default, administrators should review and apply any official fixes or configuration changes provided by SmileCDR to enforce proper partition entitlement. Until a fix is available, restrict tenant permissions carefully and monitor for unauthorized access.