CVE-2026-113874

{
  "etk_id": "ETK-2026-2487",
  "cve_id": "CVE-2026-113874",
  "display_id": "CVE-2026-113874",
  "ghsa_id": "GHSA-qw7x-rp32-35vw",
  "euvd_id": "EUVD-2026-108274",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-tenant authorization bypass in SmileCDR HAPI FHIR",
  "summary": "SmileCDR HAPI FHIR can fail to preserve tenant partition isolation when processing bundle requests. An authenticated user permitted in one tenant may access or modify data belonging to another tenant if partition entitlement enforcement is not enabled.",
  "mitigation": "Enable and enforce storage-partition entitlement checks. Configure the service so request bundle data cannot override partition identity established by trusted routing or authentication sources.",
  "vendor": "SmileCDR",
  "product": "HAPI FHIR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "HAPI FHIR",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.1375118,
  "t0_at": "2026-10-22T17:58:56.709000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T17:58:56.709000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T17:58:56.709000+00:00",
      "url": "https://github.com/advisories/GHSA-qw7x-rp32-35vw"
    }
  }
}