EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Summary Incorrect Authorization vulnerability in ash-project ash\typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in original\value becau...

CVE-2026-82730

ash_typescript (v0.11.0

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...