CVE-2026-82748

Name of the Vulnerable Software and Affected Versions ash versions 3.5.13 through 3.32.1

Description An incorrect authorization issue exists where an aggregate is authorized under one read action but computed under another. This occurs because Ash.Actions.Aggregate groups aggregates by their {authorize?, read action} and authorizes each group accordingly, but the data query selection uses opts[:action] || read action || <primary read> in the lib/ash/actions/aggregate.ex file. If a caller provides an :action option, the aggregate query executes under that action while authorization remains tied to the group's read action. If the policies of the executed action are more permissive than those of the authorized action, aggregates such as counts or sums may include records that should have been excluded, leading to unauthorized data disclosure.

Recommendations Update to version 3.32.2.