Skip to content
Threat Feed
Subscribe
high advisory

HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876)

Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.

CVE search metadata

CVE search record: CVE-2026-113873. Severity: high. CVSS: 7.5. KEV: no. Product: HAPI FHIR (8.10.0). Brief: HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/

CVE search record: CVE-2026-113874. Severity: high. CVSS: 8.1. KEV: no. Product: HAPI FHIR (8.10.0). Brief: HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/

CVE search record: CVE-2026-113875. Severity: low. CVSS: 3.1. KEV: no. Product: HAPI FHIR (8.10.0). Brief: HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/

CVE search record: CVE-2026-113876. Severity: medium. CVSS: 4.3. KEV: no. Product: HAPI FHIR (8.10.0). Brief: HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/

Triage facts

Revision 1
Applicability
HAPI FHIR (8.10.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 22, 23:52 UTC
Vulnerabilities
4 CVEs
Source quality
A1Likely

Four vulnerabilities (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876) have been identified in HAPI FHIR version 8.10.0, an open-source Java implementation of the HL7 FHIR standard. These vulnerabilities allow an authenticated user to override tenant partitions, bypass authorization controls, or induce heap exhaustion through crafted gzip payloads. The flaws enable unauthorized read or write access to data residing in partitions belonging to other tenants.

Impact

Successful exploitation allows unauthorized cross-tenant data access, leading to a compromise of data isolation. An attacker with legitimate access to one tenant could potentially read or manipulate records within another tenant partition.

Recommendation

  • Inventory all internal and external-facing instances of HAPI FHIR to identify deployments running version 8.10.0.
  • Prioritize patching or updating HAPI FHIR instances to the secure version provided by the upstream maintainers as soon as it becomes available.
  • Review access logs for abnormal cross-partition requests if HAPI FHIR multi-tenancy is in active use.
  • Restrict access to FHIR API endpoints and implement robust input validation and rate limiting to mitigate potential DoS vectors such as heap exhaustion.

Immediate actions

Inventory HAPI FHIR deployments version 8.10.0 and prepare for patching.

IT Operations 48h

Mitigations

Update HAPI FHIR to the latest patched version once released.

immediate IT Operations

CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876