CVE-2026-81643lowCWE-863

CVE-2026-81643: low-severity vulnerability in ash-project ash_graphql

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Published · Updated

Follow this CVE+ Monitor ash graphql+ Monitor ash_graphql

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.4%
Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, do_send/5 resolves the first notification of a batch and filters it with should_send?/1, which drops results whose errors are coded forbidden or not_found or carry no code, precisely so that unauthorized results are not disclosed. The remaining notifications in the batch are read from the process dictionary, re-run through the pipeline, and appended to the outgoing results without that filter. They reach pubsub.publish_subscription/2, and the not is_nil(record) guard drops only nil records, not error-carrying results. Any two qualifying notifications arriving within the default one-second batch interval suffice, and batching is the default path. The fix applies should_send?/1 to the whole batch. This issue affects ash_graphql: from 1.4.0 before 1.11.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
ash-project · ash_graphql
Related CVEs — ash-project ash_graphql

In the same product, most dangerous first.

CVE-2026-81636HIGHQuery-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of serviceEPSS 0.5%CVE-2026-78693MEDIUMIncomplete redaction re-attaches the original error path in AshGraphql, leaking internal field namesEPSS 0.5%CVE-2026-81633MEDIUMUnhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segmentEPSS 0.5%CVE-2026-80223HIGHCross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped readEPSS 0.4%CVE-2026-82367LOWRe-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicEPSS 0.4%