CVE-2026-82747

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

CVE-2026-82747

CVE-2026-82747 is an Incorrect Authorization vulnerability in ash-project ash (Elixir API framework), affecting versions 3.4.44 through 3.32.1 . The bug resides in Ash.Policy.Authorizer (lib/ash/policy/authorizer/authorizer.ex): when a resource uses an access_type: :runtime read policy, the check...