CVE-2026-47663 in Pathling
Summary
by MITRE • 08/08/2026
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The vulnerability described affects Pathling Server versions prior to 2.0.0, where the authorization mechanism fails to properly enforce access controls for FHIR operations within the clinical data analytics platform. This represents a critical authorization flaw that undermines the security model designed to protect sensitive health information. The system's typed CRUD/search/batch FHIR surface allows authenticated users with only coarse operation authorities to perform actions on attacker-chosen resource families without proper per-resource validation, creating a privilege escalation vector.
The technical flaw manifests in how Pathling Server handles authorization checks for different FHIR operations. While the documentation specifies that operation authorities such as `pathling:search` must be paired with corresponding per-resource authorities like `pathling:read:Patient`, the implementation fails to consistently enforce these requirements. Specifically, the typed search, update, and related handlers are annotated only with `@OperationAccess(...)` without performing checks against the provider-selected resource type. This means that an attacker with coarse privileges could potentially access or modify resources they should not be authorized to handle, as the system does not validate whether the user possesses the necessary per-resource read or write permissions for the specific FHIR resource family being operated upon.
The operational impact of this vulnerability is significant within healthcare environments where data protection and privacy are paramount. An authenticated attacker could exploit this flaw to perform unauthorized operations across multiple FHIR resource types, potentially accessing patient records, modifying clinical data, or conducting destructive actions such as deletions. The vulnerability affects the core functionality of the FHIR server implementation, undermining the principle of least privilege that is fundamental to healthcare information security. This type of authorization bypass could lead to data breaches, compliance violations under regulations such as HIPAA, and potential harm to patient care if clinical data becomes corrupted or accessed by unauthorized parties.
The fix implemented in Pathling Server 2.0.0 addresses this issue through proper enforcement of the documented authorization model. This update ensures that all FHIR operation entrypoints consistently validate both operation-level and per-resource authorities before allowing any actions to proceed. The resolution aligns with industry best practices for secure API development and follows the principle of defense in depth. Organizations using Pathling Server should implement immediate upgrades to version 2.0.0 or later to mitigate this vulnerability, as it represents a fundamental flaw in access control that could be exploited by attackers with minimal privileges to gain unauthorized access to clinical data resources.
This vulnerability can be classified under CWE-285 (Improper Authorization) and aligns with ATT&CK techniques related to privilege escalation and unauthorized access. The issue demonstrates the importance of implementing comprehensive authorization checks at all levels of API implementations, particularly in healthcare systems where the stakes for data security are extremely high. The fix represents a necessary improvement to ensure that Pathling Server properly enforces its intended security model and maintains the integrity of clinical data repositories against unauthorized access attempts.