CVE-2026-82747
Description
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible. This issue affects ash: from 3.4.44 before 3.32.2.
How to fix
- ash-project ash3.32.2, 6eddb8ab26e45023faf0c79ebd152bb40aefda02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash | 3.4.44 ≤ v < 3.32.2, f4a8ff53fd3b974468d73685cd3fc842ef893de3 ≤ v < 6eddb8ab26e45023faf0c79ebd152bb40aefda02 | 3.32.2, 6eddb8ab26e45023faf0c79ebd152bb40aefda02 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.