CVE-2026-47662: Pathling Server Auth Bypass Vulnerability

CVE-2026-47662 Overview

CVE-2026-47662 is a broken access control vulnerability in Pathling Server, a toolkit for using FHIR (Fast Healthcare Interoperability Resources) and clinical terminology in health data analytics. Versions prior to 2.0.0 fail to enforce per-resource read and write authorities on typed CRUD, search, and batch FHIR endpoints. Authenticated callers holding only coarse operation authorities can act on attacker-chosen resource families, including sensitive clinical data such as Patient resources. The typed search, update, and related handlers are annotated only with @OperationAccess(...) and do not check the corresponding per-resource authority defined by the documented authorization model.

Critical Impact
Authenticated users with limited operation authorities can bypass per-resource access controls to read or modify FHIR resources they are not authorized to access, exposing protected health information.

Affected Products

Pathling Server versions prior to 2.0.0
Deployments exposing typed FHIR CRUD, search, update, and batch endpoints
Health data analytics pipelines relying on Pathling's documented per-resource authorization model

Discovery Timeline

2026-08-07 - CVE-2026-47662 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-47662

Vulnerability Analysis

Pathling documents an authorization model that requires two authorities for every FHIR operation. Callers must hold an operation authority such as pathling:search and a matching per-resource authority such as pathling:read:Patient or pathling:write:Observation. Delete and batch operations are documented to require write authority for every referenced resource type.

The implementation deviates from this model. Typed search, update, and related handlers are decorated only with @OperationAccess(...), which validates the operation authority but skips the per-resource authority check. As a result, an authenticated caller with pathling:search alone can query any resource family the provider selects, regardless of which pathling:read:<ResourceType> authorities they hold. The same gap affects typed update and batch paths, allowing unauthorized writes.

This condition maps to [CWE-20 Improper Input Validation] as tracked in the NVD entry, though the underlying weakness is a missing authorization check on the resource type parameter.

Root Cause

The root cause is inconsistent enforcement of the documented two-part authorization model in the typed FHIR surface. Handler annotations validate only the coarse operation authority. The provider-selected resource type is trusted without a corresponding authority check against the authenticated principal.

Attack Vector

An authenticated attacker sends a typed FHIR request such as a search or update against a resource family they should not access. The server evaluates the operation authority, finds it present, and executes the handler against the requested resource type. No per-resource authority is checked, and the operation succeeds. Batch and delete requests can reference resource types outside the caller's granted write scope.

See the GitHub Security Advisory for maintainer-provided technical details.

Detection Methods for CVE-2026-47662

Indicators of Compromise

FHIR API access logs showing a principal invoking operations on resource types outside their documented pathling:read:<Type> or pathling:write:<Type> grants.
Batch or transaction bundles referencing resource types that the caller lacks explicit write authority for.
Unusual volume of typed search or update requests from accounts holding only coarse operation authorities.

Detection Strategies

Correlate authentication tokens or JWT claims against the resource types accessed in each Pathling request, and alert on mismatches with the documented per-resource authority model.
Enable Pathling and reverse-proxy access logging, then baseline expected resource-type usage per client so out-of-scope access can be flagged.
Review audit trails for update, delete, and batch operations against sensitive resource families such as Patient, Observation, and Condition.

Monitoring Recommendations

Ingest Pathling application logs and upstream API gateway logs into a centralized analytics platform for retention and query.
Monitor for privilege drift where service accounts accumulate operation authorities without matching per-resource authorities.
Alert on FHIR batch bundles that mix resource types beyond a caller's expected scope.

How to Mitigate CVE-2026-47662

Immediate Actions Required

Upgrade Pathling Server to version 2.0.0 or later, which enforces per-resource read and write authorities on typed endpoints.
Inventory all Pathling clients and service accounts, and review granted authorities against the documented authorization model.
Restrict network exposure of Pathling FHIR endpoints to trusted internal callers until the patched version is deployed.

Patch Information

The issue is fixed in Pathling Server 2.0.0. Refer to the GitHub Security Advisory GHSA-26hp-x47g-x95q for release notes and upgrade guidance.

Workarounds

Place Pathling behind an API gateway or authorization proxy that validates per-resource authority claims against the requested FHIR resource type before forwarding requests.
Reduce blast radius by issuing tokens that carry only the minimum operation authorities needed, avoiding broad grants like pathling:search without paired per-resource authorities.
Disable or block typed update, delete, and batch endpoints for clients that do not require them until upgrade is complete.

bash

# Example API gateway rule: require matching per-resource authority
# Pseudocode for a request filter enforcing the documented model
if request.path matches "/fhir/(?<type>[A-Za-z]+)(/.*)?" then
  require_claim("authorities", "pathling:read:${type}")   # for GET/search
  require_claim("authorities", "pathling:write:${type}")  # for PUT/POST/DELETE
else
  deny