PT-2026-106202

Name of the Vulnerable Software and Affected Versions ash versions 3.5.1 through 3.34.2 Description Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is used in a filter, the comparison value is processed through Ash.Type.Atom. Due to the absence of...

PT-2026-98374

Name of the Vulnerable Software and Affected Versions ash versions 2.17.15 through 3.33.10 Description An Improperly Controlled Modification of Dynamically-Determined Object Attributes allows users to set values for private action arguments during bulk destroy and bulk update operations. Argument...

CVE-2026-85500: Authentication Bypass by Primary Weakness

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

PT-2026-94299

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.3.8 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authentication bypass allows unconfirmed users to obtain a session, bypassing mandatory email confirmation requirements...

PT-2026-93377

Name of the Vulnerable Software and Affected Versions ash versions 2.11.0-rc.0 through 3.33.3 Description Field policies are intended to prevent information disclosure by replacing fields an actor cannot see with a nil expression when used in a filter, preventing the filter from acting as a yes/n...