Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

Summary When using filter authorization, two edge cases could cause the policy compiler/authorizer to generate a permissive filter: 1. Bypass policies whose condition can never pass at runtime were compiled as ORANDcondition, compiledpolicies, NOTcondition. If the condition could never be true at...

CVE-2025-48043

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 0.1.1 before 3.6.2...

Ash Framework 安全漏洞

Ash Framework is an Ash Framework open source framework for building Elixir applications. A security vulnerability exists in Ash Framework versions prior to 3.6.2 that stems from improper authorization and could lead to authentication bypass...

EUVD-2024-3055

Malicious code in bioql PyPI...

GHSA-JJ4J-X5WW-CWH9 Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

Summary Certain bulk action calls with a beforetransaction hook and no aftertransaction hook, will call the beforetransaction hook before authorization is checked and a Forbidden error is returned, when called as a bulk action. The impact is that a malicious user could cause a beforetransaction t...

Incorrect Authorization

Overview ash is an A declarative, extensible framework for building Elixir applications. Affected versions of this package are vulnerable to Incorrect Authorization when running a bulk of action calls with a beforetransaction hook and no aftertransaction hook. A malicious user could cause a...

EEF-CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden

Summary Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from 0.1.1 before 3.5.39...

CVE-2025-48042

CVE-2025-48042 (ash) is an Incorrect Authorization vulnerability affecting ash where running a bulk action with a before_transaction hook and no after_transaction hook could cause a before_transaction to execute before authorization is checked. Affected versions are ash from pkg:hex/ash prior to ...

Ash Framework 安全漏洞

Ash Framework is an Ash Framework open source framework for building Elixir applications. A security vulnerability exists in Ash Framework versions prior to 3.5.39 that stems from improper authorization and could lead to an access control bypass...

The vulnerability of the PostgreSQL database extension Ash Postgres lies in the Ash Framework, which allows a hacker to execute arbitrary code.

The vulnerability of the extension for using the PostgreSQL database, Ash Postgres framework, is related to the use of files and directories accessible to external parties. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by replacing the installation files...

CVE-2024-49756 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions no changing fields, and would...

CVE-2024-49756 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions no changing fields, and would...

CVE-2024-49756: Files or Directories Accessible to External Parties

AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions no changing fields, and would...