CVE-2026-47663

Received Received - Intake

Authorization Bypass in Pathling Server

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-47663

EUVD

EUVD-2026-54649

Affected Vendors & Products

Vendor	Product	Version / Range
pathling	pathling_server	to 2.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Pathling Server versions before 2.0.0. It allows authenticated users with limited permissions to perform unauthorized actions on FHIR resource types by exploiting inconsistencies in authorization checks. The system's documented model requires specific per-resource read or write permissions, but certain operations bypass these checks and act on attacker-chosen resource families.

Detection Guidance

This vulnerability requires checking if Pathling Server versions prior to 2.0.0 are running and if authorization checks are properly enforced for FHIR operations. Inspect server logs for unauthorized access attempts or resource manipulation. Verify configuration files for correct authority mappings. No specific commands are provided in the context.

Impact Analysis

An attacker with minimal access could read or modify sensitive health data stored in the FHIR server, potentially leading to data breaches, unauthorized modifications, or compliance violations. The impact depends on the data stored and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of protected health information, violating HIPAA and GDPR requirements for data confidentiality and access controls. Organizations using affected versions may face compliance penalties and reputational damage.

Mitigation Strategies

Upgrade Pathling Server to version 2.0.0 or later to address the authorization bypass issue in typed CRUD/search/batch FHIR endpoints.

Hi! I’m here to help you understand CVE-2026-47663. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70