CVE-2026-77454

Name of the Vulnerable Software and Affected Versions ash sql versions 0.4.1 through 0.7.0

Description An incorrect authorization issue allows a caller to bypass scoping or authorization filters expressed as exists/2 over a relationship that declares both a limit (or from many?) and a filter or sort referencing parent(...). The AshSql.Join.related query/3 function skips the caller-supplied exists predicate and delegates it to limit from many/5. When the relationship's filter or sort references parent(...), limit from many/5 drops both the limit and the predicate, resulting in a bare correlated EXISTS. This causes the check to match any record with any related row. In policy contexts, such as authorize if expr(exists(memberships, user id == ^actor(:id))), the actor-scoping condition is removed, allowing the policy to pass for any actor with any related row.

Recommendations Update ash sql to version 0.7.1 or later.