Vulnerabilities in ash-project
91 resultsCVE-2026-82746MEDIUMAsh.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsEPSS 0.2%CVE-2026-82747MEDIUMAsh.Policy.Authorizer returns records denied by a runtime read policy to any actorEPSS 0.2%CVE-2026-82749MEDIUMAsh relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped recordsEPSS 0.2%CVE-2026-82748LOWAsh.Actions.Aggregate authorizes an aggregate under one action but computes it under anotherEPSS 0.2%CVE-2026-81318LOWDistinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSqlEPSS 0.2%CVE-2026-81316LOWSame-named aggregates with differing filters are conflated in AshSqlEPSS 0.2%CVE-2026-82745MEDIUMETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniquenessEPSS 0.2%CVE-2026-78699HIGHrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresEPSS 0.2%CVE-2026-75847MEDIUMSensitive attribute values stored in a non-sensitive public changes map in AshPaperTrailEPSS 0.1%CVE-2026-77970MEDIUMSensitive fields nested in embedded values are not redacted in AshPaperTrail versionsEPSS 0.1%CVE-2026-81322LOWCloaked plaintext leaks through a non-sensitive action argument in AshCloakEPSS 0.1%