CVE-2026-78216
Description
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_lua: from 0.1.0 before 0.2.2.
How to fix
- ash-project ash_lua0.2.2, 266a5dcc56d5015b6d316c10606169e753b07450 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_lua | 0.1.0 ≤ v < 0.2.2, 8675e47cca81f36594083a7e63379bac9e123e72 ≤ v < 266a5dcc56d5015b6d316c10606169e753b07450 | 0.2.2, 266a5dcc56d5015b6d316c10606169e753b07450 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.