Authentication Bypass Vulnerability in Pathling Server by AEHRC
CVE-2026-47663

8.7HIGH

Key Information:

Vendor

Aehrc

Status
Pathling
Vendor
CVE Published:
7 August 2026

What is CVE-2026-47663?

An authentication bypass issue exists in Pathling Server prior to version 2.0.0, where authenticated users with basic operation authorities can exploit the FHIR interface to manipulate selected resource families without proper per-resource authority enforcement. The system fails to consistently check the necessary read or write permissions for operations such as search and update, leading to unauthorized access. This vulnerability poses a risk to the integrity of health data analytics, disrupting compliant operations. The issue has been addressed in Pathling Server version 2.0.0.

Affected Version(s)

pathling < 2.0.0

References

https://github.com/aehrc/pathling/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.