AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-47662

HIGH · CVSS 8.7 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-07 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability affects Pathling Server versions prior to 2.0.0, where an authenticated user with limited operation authorities can manipulate resources due to inconsistent enforcement of per-resource read and write permissions. This flaw can lead to unauthorized access and modification of sensitive health data, posing significant risks to patient privacy and data integrity. Healthcare organizations utilizing Pathling should prioritize upgrading to version 2.0.0 to mitigate these risks effectively.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47662
Severity
HIGH
CVSS
8.7
EPSS
0.24%

Original NVD Description

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.