CVE-2026-81643

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.4.0 through 1.10.x

Description An incorrect authorization issue exists where GraphQL subscription payloads are delivered for records that a subscriber is not authorized to view. In the AshGraphql.Subscription.Batcher module, the do send/5 function filters the first notification of a batch using should send?/1 to drop results with forbidden or not found errors. However, subsequent notifications in the batch are processed and appended to the results without this filter. These notifications then reach pubsub.publish subscription/2, where the guard only drops nil records, allowing error-carrying results to be disclosed. This occurs when two or more qualifying notifications arrive within the default one-second batch interval.

Recommendations Update ash graphql to version 1.11.0 or later.