SmileCDR has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 5.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
SmileCDR vulnerabilities
CVEs affecting SmileCDR, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-113876Medium· 4.3SmileCDR HAPI FHIR unauthorized read
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target r…
CVE-2026-113874High· 8.1SmileCDR HAPI FHIR trusted tenant partition override
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read …
CVE-2026-113875Low· 3.1SmileCDR HAPI FHIR unauthorized read via subscription
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.
CVE-2026-113873High· 7.5SmileCDR HAPI FHIR improper data decompression
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.