CVE-2026-81643

CVE-2026-81643 is a broken access control flaw in ash_graphql (versions 1.4.0 through 1.10.0 ). In AshGraphql.Subscription.Batcher, the should_send?/1 authorization filter is applied only to the first notification in a batch; remaining notifications are appended to outgoing results without that f...

CVE-2026-82367

CVE-2026-82367 is a re-entrant data-exposure bug in ash_graphql (ash-project), affecting versions 1.4.0 through before 1.11.0 . The root cause lies in AshGraphql.Subscription.Batcher.do_send/5, which reads and deletes the process-dictionary key :batch_resolved without namespacing it per run. On t...