Loading vulnerability…
Unauthorized Resource Disclosure in HAPI FHIR Conditional Create
CVE-2026-113876 is an incorrect-authorization vulnerability in HAPI FHIR conditional-create processing. A caller with CREATE permission but without READ permission can submit a conditional POST whose If-None-Exist predicate matches exactly one existing resource. When returning a representation, the server responds with HTTP 200 and the complete stored resource without creating a new resource. AuthorizationInterceptor treats CREATE as an inbound operation and skips the outgoing-resource authorization check for the matched resource, bypassing restrictions enforced on direct reads. The vulnerability was reproduced on HAPI FHIR 8.10.0; source inspection also identified the vulnerable code path in versions 8.8.2, 8.10.1, and 8.12.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Users authorized to create resources can obtain existing FHIR resources outside their permitted read scope, potentially exposing complete patient records and sensitive clinical information. Testing demonstrated disclosure of a stored Patient despite the same caller receiving HTTP 403 on a direct read. The demonstrated operation did not create or modify a resource, and resource enumeration was not demonstrated.
If you can’t patch tonight, do this now.
Until a corrected release is deployed, restrict conditional-create operations for callers lacking READ permission, or temporarily revoke their CREATE permission where operationally feasible. No vendor-provided workaround is identified. Blocking direct reads alone does not prevent this disclosure path.
Patch, then assume compromise.
Deploy a release containing upstream pull request #8254, which suppresses the conditional-create response body. The change merged into master on August 19, 2026, but no release tag contained it as of October 22, 2026. It was scheduled for HAPI FHIR 9.0.0 on November 19, 2026. Although the CVE record describes a fix around September 2026, it does not identify a fixed release; verify inclusion of the correction with the vendor rather than relying on that date. For embedded HAPI FHIR deployments, obtain the corresponding corrected product release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.