CVE-2026-113876

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,3
Source: 9119a7d8-5eab-497f-8521-727c672e3725
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

863

Incorrect Authorization

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control Availability
Potential Impacts:
Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Bypass Protection Mechanism Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)
Applicable Platforms
Technologies: Web Server, Database Server, Not Technology-Specific
Likelihood of Exploit: High
View CWE Details
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf…
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026…
https://www.cve.org/CVERecord?id=CVE-2026-113876
https://www.cve.org/CVERecord?id=CVE-2026-113876