EEF-CVE-2026-82747
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82747.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82747.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-82747
- Aliases
-
- CVE-2026-82747
- GHSA-4259-gvr2-4xhq
- Published
- 2026-09-01T04:14:57.840Z
- Modified
- 2026-09-01T04:25:40.370214893Z
- Severity
-
- 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
- Details
-
Summary
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor.
When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible.
This issue affects ash: from 3.4.44 before 3.32.2.
- Database specific
{ "cwe_ids": [ "CWE-863" ], "capec_ids": [ "CAPEC-1" ], "cpe_ids": [ "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*" ] }- References
- Credits
-
-
- Jonatan Männchen / EEF - COORDINATOR
-
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
-
- Peter Ullrich - REPORTER
-
- Peter Ullrich - FINDER
-
Affected packages
Hex / ash
Package
- Name
- ash
- Purl
- pkg:hex/ash