Jesse Williams

**Name of the Vulnerable Software and Affected Versions** ash versions 2.11.0-rc.0 through 3.33.3 **Description** Field policies are intended to prevent information disclosure by replacing fields an actor cannot see with a `nil` expression when used in a filter, preventing the filter from acting as a yes/no oracle. However, this mechanism was only applied to attributes and not to calculations or aggregates. Because user-supplied filter references to calculations or aggregates use `Ash.Query.Calculation` or `Ash.Query.Aggregate` structs, they bypassed the authorizer's reference replacement which only matched `Ash.Resource.*` structs. Consequently, an actor forbidden from accessing a calculation or aggregate can still filter by it, allowing them to deduce protected values based on whether rows match. This is particularly risky when filtering is exposed to lower-privileged actors via AshGraphql or AshJsonApi filter arguments. **Recommendations** Update ash to version 3.33.4 or later.