Pathling Server versions before 2.0.0 have an improper authorization vulnerability (CWE-285) in their typed FHIR CRUD/search/batch interfaces. Authenticated callers with broad operation-level permissions (e.g., pathling:search) can perform actions on resource types without the required per-resource read or write authorities (e.g., pathling:read:Patient). While delete and batch operations require write authority for all referenced resource types, typed search, update, and related handlers only check operation-level access and do not enforce per-resource authorization. This inconsistency allows unauthorized access to attacker-chosen resource families. The issue is resolved in Pathling Server 2.0.0.

An attacker with authenticated access and coarse operation-level permissions can perform unauthorized actions on resource families they should not have access to, potentially exposing or modifying sensitive health data. This violates the intended fine-grained authorization model and could lead to unauthorized data access or modification within health data analytics environments using Pathling Server prior to 2.0.0.

Upgrade to Pathling Server version 2.0.0 or later, where this improper authorization issue is fixed. No other mitigation or workaround is documented. Patch status is not explicitly stated, but the fix is included in version 2.0.0.