Pathling Server versions before 2.0.0 have an authorization flaw in their typed CRUD/search/batch FHIR surface. Authenticated callers with only broad operation authorities (e.g., pathling:search) can perform actions on attacker-chosen resource families because the system fails to consistently enforce the required per-resource read or write authorities (e.g., pathling:read:Patient). While delete and batch operations require write authority for all referenced resource types, typed search, update, and related handlers only check for operation-level access and do not verify per-resource permissions. This improper input validation leads to unauthorized access and modification of resources. The vulnerability is addressed in Pathling Server 2.0.0.

An attacker with authenticated access and coarse operation-level permissions can bypass per-resource authorization controls, potentially accessing or modifying FHIR resources they should not have permission for. This could lead to unauthorized disclosure or alteration of sensitive health data. The vulnerability affects confidentiality and integrity of data handled by Pathling Server prior to version 2.0.0.

Upgrade to Pathling Server version 2.0.0 or later, where this authorization issue is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly confirmed beyond the fix in version 2.0.0; users should verify with the vendor advisory for the latest remediation guidance.