The vulnerability arises from an authorization flaw in the SmileCDR HAPI FHIR server when REST‑hook subscriptions are enabled. Users who possess permission to create subscriptions are able to query and read resources that they would normally be denied access to. This flaw allows an attacker to gain read access to protected data, leading to a violation of confidentiality. The weakness is reflected by CWE-862, which classifies it as a missing authorization check.

The affected product is the SmileCDR HAPI FHIR server. Any deployment that has REST‑hook subscriptions enabled and assigns a user the capability to create subscriptions is vulnerable. No specific version constraints are listed, so all current releases that expose this configuration are potentially impacted.

The CVSS score is 2.3, indicating low severity. Exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires that the attacker first be authorized with subscription‑creation rights, the attack vector is likely internal or authenticated. An adversary who can obtain such permissions could read restricted resources, but external unauthenticated exploitation is not supported according to the available description.