CVE-2026-82749
Description
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil. This issue affects ash: from 3.13.2 before 3.32.2.
How to fix
- ash-project ash3.32.2, e52dad2c39a35f6f043f7324d26e4f4e2551dfd2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash | 3.13.2 ≤ v < 3.32.2, 0ddff26e6e6bc6d182e1af2f98b431575e5b4179 ≤ v < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2 | 3.32.2, e52dad2c39a35f6f043f7324d26e4f4e2551dfd2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.