EEF-CVE-2025-48044
- Source
- https://cna.erlef.org/osv/EEF-CVE-2025-48044.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2025-48044.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2025-48044
- Aliases
- Published
- 2025-10-17T13:52:53.644Z
- Modified
- 2025-11-03T00:12:34.021128Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Authorization bypass when bypass policy condition evaluates to true
- Details
-
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2.
This issue affects ash: from pkg:hex/ash@3.6.3 before pkg:hex/ash@3.7.1, from 3.6.3 before 3.7.1, from 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "cpe_ids": [ "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*" ], "capec_ids": [ "CAPEC-115" ] }- References
- Credits
-
-
- Jechol Lee - REPORTER
-
- Jechol Lee - REMEDIATION_DEVELOPER
-
- Jonatan Männchen - ANALYST
-
- Zach Daniel - REMEDIATION_REVIEWER
-
Affected packages
Hex / ash
Package
- Name
- ash
- Purl
- pkg:hex/ash