CVE-2026-82730

ash_typescript (v0.11.0

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Summary Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because...