CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.AshGraphql.Subscription.Batcher'"
    ],
    "packageName": "ash_graphql",
    "packageURL": "pkg:hex/ash_graphql",
    "product": "ash_graphql",
    "programFiles": [
      "lib/subscription/batcher.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.AshGraphql.Subscription.Batcher':do_send/5"
      }
    ],
    "repo": "https://github.com/ash-project/ash_graphql",
    "vendor": "ash-project",
    "versions": [
      {
        "lessThan": "1.11.0",
        "status": "affected",
        "version": "1.4.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.AshGraphql.Subscription.Batcher'"
    ],
    "packageName": "ash-project/ash_graphql",
    "packageURL": "pkg:github/ash-project/ash_graphql",
    "product": "ash_graphql",
    "programFiles": [
      "lib/subscription/batcher.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.AshGraphql.Subscription.Batcher':do_send/5"
      }
    ],
    "repo": "https://github.com/ash-project/ash_graphql",
    "vendor": "ash-project",
    "versions": [
      {
        "lessThan": "e8e67f39add2ce0771e6db5f086afe68ba212c57",
        "status": "affected",
        "version": "3cb2c9870d050c7c4bba6c211aaed97d732f7e81",
        "versionType": "git"
      }
    ]
  }
]