CVE-2026-47662

Received Received - Intake

Authorization Bypass in Pathling Server

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-47662

EUVD

EUVD-2026-54648

Affected Vendors & Products

Vendor	Product	Version / Range
pathling	pathling_server	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Pathling Server before version 2.0.0 allows authenticated users with limited operation authorities to perform unauthorized actions on FHIR resource families. The issue occurs because the system does not properly enforce per-resource read and write permissions when handling typed CRUD, search, or batch operations. Attackers can exploit this to access or modify data they should not be able to.

Detection Guidance

This vulnerability requires checking Pathling Server versions prior to 2.0.0 and verifying authorization enforcement for FHIR operations. Check server version with: curl -s http://<server>/version | grep version. Review logs for unauthorized FHIR operations or resource access attempts. Ensure per-resource read/write authorities are enforced for typed CRUD/search/batch endpoints.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive health data, unauthorized modifications to patient records, or improper data deletion. Organizations using affected Pathling Server versions may face data breaches, compliance violations, or loss of trust in their systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access or disclosure of protected health information. GDPR requires strict data access controls, while HIPAA mandates safeguards for patient data. Exploitation could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Pathling Server to version 2.0.0 or later to address the authorization bypass issue.

Hi! I’m here to help you understand CVE-2026-47662. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70