CVE-2026-47662 Details
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
An authorization bypass vulnerability has been identified in Pathling Server versions prior to 2.0.0. This vulnerability allows authenticated users with only coarse operation authorities to manipulate attacker-chosen resource families. The issue arises because the typed CRUD, search, and batch FHIR entrypoints do not consistently enforce the required per-resource read and write authorities. As a result, a low-scope caller can exploit this to access or modify protected health information (PHI) across different resource types, undermining resource-family isolation. The vulnerability also affects delete and batch operations, potentially amplifying the impact by allowing widespread write-side damage across multiple resource families.
The vulnerability has been fixed in Pathling Server version 2.0.0. Users should upgrade to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aehrc/pathling/security/advisories/GHSA-26hp-x47g-x95q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/aehrc/pathling/security/advisories/GHSA-26hp-x47g-x95q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| au.csiro.pathling-server | <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |