CVE-2026-82730
- Source
- https://cve.org/CVERecord?id=CVE-2026-82730
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82730.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82730
- Aliases
-
- EEF-CVE-2026-82730
- GHSA-6929-rjmh-4x62
- Published
- 2026-09-01T02:09:01.851Z
- Modified
- 2026-09-02T03:47:32.226438487Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Authorization-redacted field values disclosed through AshTypescript result normalization
- Details
-
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.
When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in originalvalue because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalizeprimitive/1 in lib/ashtypescript/rpc/resultprocessor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.fromstruct/1 and serializes every key, originalvalue included. The denied value is returned to the caller inside the marker that represents its own denial.
The simplest trigger is an action returning an embedded resource as a map, which routes through normalizeresourcestruct/2 with an empty template. normalizevaluefor_json/1 is a public, unguarded entry point to the same path.
This issue affects ash_typescript: from 0.11.0 before 0.18.0.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82730.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "9cade7661a01b6e4d940386f482f48d148dbb1e6" }, { "fixed": "aa7f9f1967b0bec806ac1156142267e805d70a55" } ] } ], "cna_assigner": "EEF", "cwe_ids": [ "CWE-863" ] }- References
-
- https://cna.erlef.org/cves/CVE-2026-82730.html
- https://github.com
- https://osv.dev/vulnerability/EEF-CVE-2026-82730
- https://repo.hex.pm
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82730.json
- https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6929-rjmh-4x62
- https://nvd.nist.gov/vuln/detail/CVE-2026-82730
- https://github.com/ash-project/ash_typescript/commit/aa7f9f1967b0bec806ac1156142267e805d70a55
- https://github.com/ash-project/ash_typescript