PT-2026-84098 · Ash · Ash
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash versions 3.13.2 through 3.32.1
Description
An incorrect authorization issue occurs when a relationship's
parent(...) scoping filter matches unintended records because a referenced parent field cannot be resolved. This happens within the resolve parent in filter/3 function (lib/ash/actions/read/relationships.ex), which resolves unresolvable parent references to nil instead of failing. Consequently, a scoping predicate like org id == parent(org id) becomes an IS NULL match, or a guard such as is nil(parent(org id)) activates its unrestricted branch, allowing the relationship to return records that the scope was intended to exclude.Recommendations
Update ash to version 3.32.2 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ash