SmileCDR HAPI FHIR accepts an untrusted bundle body that can override a partition identity set by a trusted source. The flaw fails to enforce partition entitlement by default, allowing an authenticated user with access to one tenant to read from or write to another tenant's partition. This results in a breach of confidentiality and potential integrity issues across tenants, classifying the weakness as CWE-863.

All installations of the SmileCDR HAPI FHIR component that use the default configuration which does not enforce storage partition entitlement. No specific version range is listed, so the vulnerability applies to all released versions until a fix is applied.

With a CVSS score of 8.6 the risk is high. The EPSS score is not available, so the probability of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The attack likely requires only a valid credential for one tenant and the ability to submit a crafted FHIR bundle, making it reasonably easy for any authorized user to exploit if the system is not patched.