CVE-2025-48042

High

Description

Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from 0.1.1 before 3.5.39.

SeverityHigh

CVSS7.1

Exploit probability—

ProductAsh

PublishedSep 7, 2025

First seenSep 7, 2025

Weakness typeCWE-863Incorrect authorization

How to fix

Update

ash-project ash3.5.39, 5d1b6a5d00771fd468a509778637527b5218be9a or later

Patches

github.com/ash-project/ash/commit/5d1b6a5d00771fd468a509778637527b5218be9a

Vendor advisories

github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9

Affected products

Product	Affected versions	Fixed in
ash-project ash	0.1.1 ≤ v < 3.5.39, 4c41344126b0aba09ec3085517000f8aefec299e ≤ v < 5d1b6a5d00771fd468a509778637527b5218be9a	3.5.39, 5d1b6a5d00771fd468a509778637527b5218be9a

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.