CVE-2026-101028mediumCWE-863

CVE-2026-101028: falha de média gravidade em ash-project ash

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Publicada em

Seguir esta CVE+ Monitorar ash+ Monitorar ash

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 0.3%
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected. This issue affects ash: from 2.6.0 before 3.34.6.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ash-project · ash
CVEs relacionadas — ash-project ash

No mesmo produto, das mais perigosas para as menos.

CVE-2025-48044HIGHAuthorization bypass when bypass policy condition evaluates to trueEPSS 0.7%CVE-2026-67579HIGHFilter expression injection via forged keyset pagination cursor in AshEPSS 0.6%CVE-2026-34593HIGHAsh Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crashEPSS 0.4%CVE-2026-86338MEDIUMAsh field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracleEPSS 0.4%CVE-2025-48043HIGHBypass and runtime policies that can never pass may be incorrectly applied in filter authorizationEPSS 0.4%CVE-2026-69659MEDIUMMemory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.KeysetEPSS 0.4%