CVE-2026-47662

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0

Description Pathling Server contains an authorization bypass in its typed CRUD, search, and batch FHIR surface. Authenticated users with coarse operation authorities can interact with resource families chosen by an attacker because certain entrypoints fail to consistently enforce per-resource read and write authorities. While the authorization model requires operation authorities (such as pathling:search) to be paired with specific per-resource authorities (such as pathling:read:Patient), typed search, update, and related handlers use the @OperationAccess(...) annotation and process the provider-selected resource type without verifying the required per-resource authority.

Recommendations Update to version 2.0.0.