PT-2026-84078 · Unknown · Ash Typescript
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash typescript versions 0.11.0 through 0.17.0
Description
An incorrect authorization issue allows an unauthorized RPC caller to read attribute values that field policies were intended to deny. When a field policy denies an attribute, the system uses a marker that retains the actual value in the
original value field to ensure embedded resources remain writable. While most paths strip these markers, the normalize primitive/1 function in lib/ash typescript/rpc/result processor.ex lacks this logic, causing the marker to be serialized via Map.from struct/1. Consequently, the denied value is returned to the caller. This can be triggered by an action returning an embedded resource as a map or through the public normalize value for json/1 entry point.Recommendations
Update ash typescript to version 0.18.0 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ash Typescript