Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: SmileCDR Clear all filters
TI-2026-79415 CVE-2026-113875 · GHSA-67jf-xf85-qx94

Missing authorization in SmileCDR HAPI FHIR allows unauthorized reads

Priority LOW 12

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00271 Published 2026-10-22 No fix listed CWE-862
TI-2026-79414 CVE-2026-113874 · GHSA-qw7x-rp32-35vw

Incorrect authorization in SmileCDR HAPI FHIR lets tenants cross partitions

Priority LOW 37

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00323 Published 2026-10-22 No fix listed CWE-863
TI-2026-79413 CVE-2026-113873 · GHSA-36fr-h72x-63ph

Decompression flaw in SmileCDR HAPI FHIR enables denial of service

Priority MEDIUM 44

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00522 Published 2026-10-22 No fix listed CWE-409