EEF-CVE-2026-78230

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-78230.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-78230.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-78230
Aliases
  • CVE-2026-78230
  • GHSA-v5rw-36x5-r5vx
Published
2026-09-08T16:41:45Z
Modified
2026-09-08T16:56:02Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
AshAi aggregate tool can read field-policy-protected fields
Details

Summary

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.

Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.

The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.

This issue affects ash_ai: from 0.1.0 before 1.0.3.

Configurations

Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute).

Database specific 
{
    "capec_ids": [
        "CAPEC-1"
    ],
    "cpe_ids": [
        "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-1220"
    ]
}
References
Credits
    • Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - COORDINATOR
    • Aaron Hong / Remedy - FINDER

Affected packages

Hex / ash_ai

Package

Name
ash_ai
Purl
pkg:hex/ash_ai

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Fixed
1.0.3

Affected versions

0.*
0.1.0
0.1.1
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.3.0
0.4.0
0.5.0
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1
0.8.2
1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-78230.json"

Git / github.com/ash-project/ash_ai

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_ai
Events
Introduced
2ba234b50946a3b8116190c8467f9f4dfa5edce7
Fixed
9c02de581625c342c9870a672830bff28c1d701e

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.8.0
v0.8.1
v0.8.2
v1.*
v1.0.0
v1.0.1
v1.0.2

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-78230.json"