Which versions of Pathling Server are affected by CVE-2026-47662?

Pathling Server versions prior to 2.0.0 contain an authorization bypass vulnerability that permits authenticated users holding only basic permissions to access unauthorized FHIR resource types and…. A patch is available.

How to fix or mitigate CVE-2026-47662?

Within 24 hours, identify all Pathling Server instances in your environment and document current versions in use. Within 7 days, upgrade all affected Pathling Server installations to version 2.0.0 or later, testing in staging environments before production deployment. Within 30 days, review and audit access logs from affected systems to identify any unauthorized access to clinical records by users lacking required per-resource permissions, and initiate breach notification procedures if evidence of unauthorized FHIR resource access is discovered.

Pathling Server CVE-2026-47662

Q: What is the CVSS score of CVE-2026-47662?

CVE-2026-47662 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54648 HIGH

Improper Input Validation (CWE-20)

2026-08-07 GitHub_M

Information Disclosure Pathling Aehrc

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

PR:L reflects description-confirmed authentication requirement; I:L added because update handlers are also named as vulnerable, enabling unauthorized writes.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 07, 2026 - 21:02 EUVD

Analysis Generated

Aug 07, 2026 - 20:51 vuln.today

CVE Published

Aug 07, 2026 - 20:23 cve.org

HIGH 8.7

DescriptionCVE.org

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource read and write authorities. The documented authorization model requires an operation authority (e.g. pathling:search) to be paired with the matching per-resource read or write authority (e.g. pathling:read:Patient). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with @OperationAccess(...) and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.

AnalysisAI

Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., pathling:search) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., pathling:read:Patient), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with @OperationAccess(...) and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.

Technical ContextAI

Pathling is an open-source toolkit (maintained by AEHRC) that exposes a typed FHIR CRUD, search, and batch API surface for health data analytics. Its documented two-factor authorization model requires both an operation authority (e.g., pathling:search) and a matching per-resource authority (e.g., pathling:read:Patient) to be present before any resource type is accessed. The defect, classified under CWE-20 (Improper Input Validation), arises because certain endpoint handlers - typed search, update, and related operations - carry only the @OperationAccess(...) annotation and do not programmatically validate the caller's per-resource authority before dispatching to the provider-selected resource type. Delete and batch handlers are documented to require write authority for all referenced resource types, but the enforcement gap in typed search and update paths allows the provider-selected resource type to bypass this second authorization gate. The affected CPE is cpe:2.3:a:aehrc:pathling:*:*:*:*:*:*:*:*, covering all versions prior to 2.0.0.

RemediationAI

Upgrade to Pathling Server 2.0.0, which resolves the missing per-resource authority enforcement on typed search, update, and related FHIR handlers. The vendor advisory is available at https://github.com/aehrc/pathling/security/advisories/GHSA-26hp-x47g-x95q. If an immediate upgrade is not feasible, restrict network or API gateway access to Pathling's typed FHIR endpoints so that only callers holding explicitly granted per-resource authorities can reach them - this compensates for the missing in-process check but adds latency and operational complexity from policy management at the gateway layer. Additionally, audit all existing caller credentials and service accounts for overly broad operation-level authorities that lack corresponding per-resource restrictions, as those principals represent the full exploitable attack surface until the patch is applied.