EUVD-2026-54649Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated session with at least coarse operation authority (PR:L); no integrity or availability impact described; high confidentiality impact on regulated FHIR clinical data.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource read and write authorities. The documented authorization model requires an operation authority (e.g. pathling:search) to be paired with the matching per-resource read or write authority (e.g. pathling:read:Patient). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with @OperationAccess(...) and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
AnalysisAI
Pathling Server before version 2.0.0 permits authenticated callers holding only coarse operation-level authorities (e.g., pathling:search) to act on arbitrary FHIR resource families - including resource types they are not explicitly authorized to read or write - because typed search, update, and batch handlers enforce the operation-level authority check but skip the documented per-resource authority check (e.g., pathling:read:Patient). The flaw breaks the two-factor authorization model the product documents, exposing potentially all FHIR resource families to any valid operation-authority holder. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the vulnerability is fixed in Pathling Server 2.0.0.
Technical ContextAI
Pathling is a Java-based FHIR analytics server developed by AEHRC (Australian e-Health Research Centre), identified by CPE cpe:2.3:a:aehrc:pathling:*:*:*:*:*:*:*:*. It provides a FHIR R4 CRUD/search/batch surface for clinical health data analytics use cases. The root cause is CWE-285 (Improper Authorization): the typed FHIR endpoint handlers use annotation-based access control (e.g., @OperationAccess(...)) that validates only the caller's coarse operation authority but omit the second gate - the per-resource authority check. The documented authorization model requires pairing an operation authority (e.g., pathling:search) with a matching per-resource authority (e.g., pathling:read:Patient for reads, pathling:write:Condition for writes). Delete and batch operations are documented to require write authority for all referenced resource types, yet the actual handler annotations do not enforce this at the per-resource level, leaving the authorization logic structurally incomplete at the handler layer.
RemediationAI
Upgrade to Pathling Server 2.0.0, which correctly enforces per-resource authorities across all typed CRUD, search, update, and batch FHIR endpoints, per the vendor advisory at https://github.com/aehrc/pathling/security/advisories/GHSA-q62q-2m46-r7rv. If an immediate upgrade is not feasible, restrict access to Pathling's FHIR typed search and update endpoints at the API gateway or network layer, permitting only clients whose effective authority set already includes explicit per-resource grants - this eliminates the bypass for over-privileged-but-scoped callers, though it may disrupt legitimate analytics workflows. Additionally, audit all issued operation-level authorities (pathling:search, pathling:update, pathling:batch) and revoke any that are broader than operationally necessary, minimizing the pool of credentials that could be misused before patching. Note that network-layer blocking of specific FHIR endpoint types may break dependent pipelines and should be tested in a non-production environment first.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-le
The `$import-pnp` operation in Pathling Server allows low-privileged callers to supply an arbitrary `exportUrl`, causing
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today