Loading vulnerability…
Cross-tenant partition authorization bypass in HAPI FHIR
CVE-2026-113874 is an incorrect-authorization vulnerability in HAPI FHIR, a healthcare interoperability framework incorporated into Smile CDR. In deployments using header-based partition routing, an attacker-controlled transaction or batch Bundle can override a tenant partition identity established by a trusted gateway. BaseTransactionProcessor.setRequestPartitionHeaderIfEntryHasTheExtension() copies a partition identifier from a Bundle entry's request extension into the entry's sub-request header without checking the caller's entitlement to that partition. Without a separate storage-partition authorization check, an authenticated user authorized for one tenant can access another tenant's data. Exploitation was reproduced on HAPI FHIR 8.10.0, and the vulnerable code path was also identified in versions 8.8.2, 8.10.1, and 8.12.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises tenant isolation and the confidentiality and integrity of healthcare data. Demonstrated outcomes include reading resources from multiple partitions in one batch and creating a Patient resource in a foreign partition. This can expose another organization's patient records or introduce fabricated clinical records. Modification and deletion of existing foreign resources were not demonstrated.
If you can’t patch tonight, do this now.
Enable Smile CDR's partition security configuration flag when partitions are used as tenant security boundaries. For upstream HAPI FHIR deployments, enforce caller entitlement to the final selected partition through a server-side STORAGE_PARTITION_SELECTED hook or equivalent authorization control; such a hook blocked the override in testing. Prevent untrusted Bundle entries from overriding trusted partition identities. Do not rely on partition routing alone to enforce tenant isolation.
Patch, then assume compromise.
No fixed release or patch was identified as of October 22, 2026. Consult the vendor for a correction that preserves trusted partition identities and enforces authorization against the final selected storage partition. A planned November 2026 documentation update is not an identified code fix for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.