CVE-2026-47663 Overview
CVE-2026-47663 is a broken authorization vulnerability [CWE-285] in Pathling Server versions prior to 2.0.0. Pathling provides tools for using Fast Healthcare Interoperability Resources (FHIR) and clinical terminology in health data analytics. The typed CRUD, search, and batch FHIR endpoints fail to enforce documented per-resource read and write authorities. An authenticated caller holding only coarse operation authorities such as pathling:search can act on attacker-chosen resource families without possessing the matching resource-scoped authority. The maintainers fixed the issue in Pathling Server 2.0.0.
Critical Impact
Authenticated users with limited operation authorities can read or modify FHIR resources they are not authorized to access, exposing protected health information.
Affected Products
- Pathling Server versions prior to 2.0.0
- FHIR typed CRUD, search, update, and batch endpoints
- Deployments relying on per-resource pathling:read:* and pathling:write:* authorities
Discovery Timeline
- 2026-08-07 - CVE-2026-47663 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-47663
Vulnerability Analysis
Pathling's documented authorization model requires two authorities per request. An operation authority such as pathling:search must be paired with a per-resource authority such as pathling:read:Patient. Delete and batch operations must require write authority for every referenced resource type. The typed FHIR handlers do not enforce the second check consistently.
Handlers responsible for typed search, update, and related operations are annotated only with @OperationAccess(...). They operate on the provider-selected resource type without verifying the corresponding per-resource read or write authority. An authenticated caller with coarse operation authorities can therefore invoke these handlers against any resource family the provider supports.
The result is a violation of the principle of least privilege across the FHIR surface. A token issued for narrow use, such as reading Observation resources, can be exercised against sensitive families such as Patient, Practitioner, or Encounter if the handler exposes them.
Root Cause
The root cause is inconsistent authorization enforcement in Pathling Server's typed FHIR handlers. The @OperationAccess annotation validates only the operation authority. The code does not invoke the resource-scoped authority check that the documented model requires, so per-resource read and write gates are missing at the entry points for typed search, update, delete, and batch operations.
Attack Vector
An attacker authenticates to the Pathling Server with a token containing an operation authority such as pathling:search, pathling:update, or pathling:batch. The attacker then issues typed FHIR requests targeting resource types outside their granted per-resource scope. The server processes the request without evaluating the missing pathling:read:<Resource> or pathling:write:<Resource> authority. The attacker retrieves or modifies FHIR resources across resource families they should not access.
See the GitHub Security Advisory GHSA-q62q-2m46-r7rv for maintainer-provided technical details.
Detection Methods for CVE-2026-47663
Indicators of Compromise
- Authenticated FHIR requests that succeed against resource types outside the caller's documented per-resource authority scope.
- Access log entries showing a single principal issuing typed CRUD or search requests across many unrelated FHIR resource families.
- Unexpected batch or delete operations referencing resource types the caller has never previously accessed.
Detection Strategies
- Correlate issued token authorities with the resource types accessed in Pathling access logs and flag mismatches.
- Baseline per-principal FHIR resource-type access patterns and alert on deviations, especially for Patient, Practitioner, and Encounter.
- Review batch and delete request payloads for resource references outside the caller's granted pathling:write:<Resource> scope.
Monitoring Recommendations
- Enable verbose audit logging on all FHIR typed endpoints, capturing principal, granted authorities, and target resource type.
- Ship Pathling audit logs to a centralized analytics platform for continuous authorization-anomaly monitoring.
- Alert on any successful write, update, delete, or batch operation performed by tokens lacking the matching per-resource authority claim.
How to Mitigate CVE-2026-47663
Immediate Actions Required
- Upgrade Pathling Server to version 2.0.0 or later, which enforces per-resource read and write authorities on typed handlers.
- Audit issued tokens and revoke any that grant coarse operation authorities without matching resource-scoped authorities.
- Review recent FHIR access logs for unauthorized cross-resource activity performed under coarse-authority tokens.
Patch Information
The maintainers fixed CVE-2026-47663 in Pathling Server 2.0.0. The fix adds consistent per-resource authority checks to typed CRUD, search, update, delete, and batch handlers. Refer to the GitHub Security Advisory GHSA-q62q-2m46-r7rv for the full advisory and upgrade instructions.
Workarounds
- Restrict token issuance so that any principal receiving an operation authority also receives only the specific per-resource authorities they require.
- Place an authorization-aware reverse proxy in front of Pathling Server that validates per-resource scopes on typed FHIR routes.
- Disable typed CRUD, update, and batch endpoints for clients that cannot be upgraded until the 2.0.0 update is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
