CVE-2026-101028

The ash-project ash framework (versions 2.6.0 to 3.34.6 ) contains an Incorrect Authorization vulnerability in the Ash.Actions.Aggregate.run/4 function. The root cause is that the aggregate path skips applying read policies for related resources, whereas the standard read path correctly applies t...