CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-78691

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

CVE-2026-80227

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

CVE-2026-81316

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

CVE-2026-77454 exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

EUVD-2026-68198

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

CVE-2026-77454

CVE-2026-77454 is an Incorrect Authorization vulnerability in the ash-project ash_sql Elixir package, affecting versions 0.4.1 through 0.7.0 . The root cause lies in AshSql.Join.related_query/3: when a relationship declares both a limit (or from_many?) and a parent(...)-referencing filter or sort...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-81316

CVE-2026-81316 is an Incorrect Authorization flaw in ash-project ash_sql (versions 0.1.0 through before 0.7.1). The root cause lies in AshSql.Aggregate.different_queries?/2, which treats two aggregates as identical unless both their filter and sort differ. Since aggregate queries rarely carry a s...

EUVD-2026-68196

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-81316

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

EEF-CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql

Summary Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

EUVD-2026-68189

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318

ash-project ash_sql (an Elixir SQL adapter for the Ash framework) contains an incorrect authorization flaw in AshSql.AggregateQuery.add_single_aggs/5. When computing an aggregate over a distinct query , the outer query is rebuilt from query.from.source alone, dropping the query.prefix / query.fro...