The vulnerability originates in Pathling's typed CRUD/search/batch API endpoints, which skip enforcement of per‑resource read or write permissions. An authenticated user possessing a broad operation authority such as pathling:search can specify any FHIR resource type, thereby reading or modifying data outside the scope of their intended permissions. The result is the potential to exfiltrate protected health information (PHI) from the entire server or to alter data across resource families, exposing confidential patient data and compromising data integrity.

The flaw affects installations of Pathling Server prior to version 2.0.0. Any deployment using the Pathling toolset with the default authorization model is vulnerable, regardless of specific deployment environment, as the bug is inherent in the server’s native FHIR surface.

With a CVSS score of 8.7, this weakness is considered high severity. The exploitability requires only legitimate authentication and possession of the relevant operation authority, which is commonly granted to service accounts or downstream applications. Because the EPSS score is not available, the historical exploitation likelihood is unclear, but the lack of enforcement suggests that once an attacker can authenticate, the attack can proceed with minimal additional effort. The vulnerability is not currently listed in the CISA KEV catalog, indicating that no widespread public exploitation has been reported yet, yet the potential impact on PHI confidentiality and integrity remains significant.