Four Vulnerabilities in HAPI FHIR Software Threaten Healthcare Data Security
Four critical vulnerabilities discovered in the HAPI FHIR open-source software could expose sensitive patient data, bypass security controls, and disrupt healthcare services.
Independent security researcher Abhinav Agarwal has identified four significant vulnerabilities within HAPI FHIR, a widely adopted open-source software crucial for healthcare data exchange. These flaws, detailed in recent CISA advisories, pose substantial risks to patient privacy and the operational integrity of healthcare systems.
HAPI FHIR is an implementation of the Fast Healthcare Interoperability Resources (FHIR) standard, which forms the backbone of many healthcare IT systems. While the software is open-source, it is also integrated into commercial products like Smile Digital Health's Smile CDR platform. This dual nature makes it challenging for healthcare organizations to ascertain if their systems are affected, as the vulnerabilities reside in the underlying HAPI FHIR component, not solely in specific commercial applications.
The most severe vulnerability, CVE-2026-113874, carries a high severity rating and could permit an authenticated user with access to one organization's data to retrieve patient records from another organization hosted on the same system. This is possible in multi-tenant configurations that rely on header-based routing without robust verification of user authorization for each partition. Attackers could also potentially create fraudulent records within another organization's data partition.
A second high-severity flaw, CVE-2026-113873, targets server resources. An unauthenticated attacker can exploit this by sending small, compressed payloads that expand significantly before authorization checks are performed. This can lead to memory exhaustion and potential service crashes, impacting system availability.
Two additional vulnerabilities, CVE-2026-113875 and CVE-2026-113876, involve authorization weaknesses. These flaws could inadvertently expose sensitive clinical records through FHIR subscription notifications and conditional-create requests, respectively, bypassing intended security controls.
Agarwal discovered these issues in HAPI FHIR version 8.10.0. He emphasizes that consistent enforcement of authorization restrictions across all operations is vital. "The question is whether the server checks every way a patient resource can leave it," Agarwal stated. "Blocking a direct read is not enough if another operation hands over the same resource."
Smile Digital Health has acknowledged two of the vulnerabilities. Regarding CVE-2026-113874, the company noted it's exploitable only by authenticated users in deployments without partition security enabled, and their November release will clarify partitioning as a data organization feature. Customers using partitions for tenant separation and enabling the 'partition security' flag are not vulnerable. A fix for CVE-2026-113873 is also slated for the November release.
With Smile Digital Health reporting over 190 global implementations and touching over 110 million lives in the U.S., the potential impact of these vulnerabilities is significant. Healthcare providers, payers, and vendors using HAPI FHIR must ensure their systems are configured securely and apply necessary updates to protect sensitive patient data and maintain service continuity.