A missing authorization check in SmileCDR HAPI FHIR allows a user who can create resources but not read them to submit a conditional create request. If the conditional predicate matches an existing resource, the requester receives the contents of that resource, exposing potentially sensitive information without permission. The flaw does not provide code execution or denial of service, but it does compromise data confidentiality.

The vulnerability is specific to the SmileCDR HAPI FHIR platform. Any deployment of this product that relies on conditional create operations is susceptible unless the authorization controls have been updated.

The CVSS score of 5.3 indicates a moderate severity. Exploitation requires legitimate user credentials with CREATE rights and the ability to craft a conditional create. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog, suggesting no confirmed public exploits yet. However, since the flaw relies on standard user management, attackers who gain create privileges can easily learn user roles and exploit the oversight. The lack of a hard denial of read permissions for non‑READ users makes the attack relatively straightforward once the conditions are met.