Pathling Server versions before 2.0.0 have an improper authorization vulnerability (CWE-285) where the typed CRUD/search/batch FHIR interfaces allow authenticated callers with general operation authorities (e.g., pathling:search) to act on attacker-chosen resource families without verifying the required per-resource read or write authorities (e.g., pathling:read:Patient). While delete and batch operations require write authority for all referenced resource types, typed search and update handlers only check operation-level access annotations and omit per-resource authority checks. This inconsistency permits unauthorized access or modification of resources. The vulnerability is resolved in Pathling Server 2.0.0.

An attacker with authenticated access and coarse operation authority can perform unauthorized read or write actions on FHIR resource families that they should not have access to. This could lead to unauthorized disclosure or modification of sensitive health data within the Pathling Server environment. The CVSS 4.0 base score is 8.7 (high), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality.

Upgrade to Pathling Server version 2.0.0 or later, where this improper authorization issue is fixed by enforcing the documented per-resource read and write authorities consistently across all typed CRUD/search/batch handlers. Patch status is not explicitly stated beyond this fix version, so verify with the vendor advisory for any additional guidance.