2 matches found
CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...
CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...