CVE-2026-96581

A flaw was found in ash. In multitenant configurations, record creation actions configured to update existing entries upsert do not properly verify that conflicting records belong to the requesting tenant. An authenticated user can exploit this vulnerability by submitting a record identifier from...

CVE-2026-96581

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

EUVD-2026-109637

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

EEF-CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create lib/ash/actions/create/create.ex and...

CVE-2026-96581

The ash-project ash framework (versions 1.22.0 before 3.37.2 ) contains an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) within Ash.Actions.Create and Ash.Actions.Create.Bulk. Under attribute multitenancy , the software fails to scope conflicting records to the request'...

CVE-2026-115627

Incorrect Authorization vulnerability in ash-project ashpostgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a manytomany relationship, or a through relationship, is loaded with a lateral join for example with a per-record limi...

CVE-2026-114214

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone through...

CVE-2026-114214

A flaw was found in Ash. This vulnerability allows an authenticated attacker to access unauthorized records, resulting in information disclosure. When querying associated data through intermediate relationships with a limit of one, the framework fails to apply the filter linking destination recor...

CVE-2026-114214

An incorrect authorization vulnerability exists in ash: from version 3.24.0 before 3.37.1 . The flaw occurs in the lateral_join?/4 function within lib/ash/actions/read/relationships.ex. When loading a has_many relationship with a through: declaration and a limit of 1, or an unsorted has_one throu...

EEF-CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Summary Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone...

CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone through...

EUVD-2026-109567

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone through...

PT-2026-123117

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has one through...

CVE-2026-101028

A flaw was found in the Ash framework. An authorized user can infer sensitive information from restricted related records by submitting queries that use aggregate functions, such as counting or checking for record existence. Because read authorization policies on related resources are not enforce...

CVE-2026-101028

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...

EEF-CVE-2026-101028 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Summary Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before runnin...

CVE-2026-101028

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...

CVE-2026-101028

The ash-project ash framework (versions 2.6.0 to 3.34.6 ) contains an Incorrect Authorization vulnerability in the Ash.Actions.Aggregate.run/4 function. The root cause is that the aggregate path skips applying read policies for related resources, whereas the standard read path correctly applies t...