CVE-2026-115627

The ash_postgres component (versions 0.38.0 before 2.15.2 ) is vulnerable to an Incorrect Authorization issue (CWE-863). When loading many_to_many or through relationships using a lateral join (such as with sorting or per-record limits), the AshPostgres.DataLayer fails to execute the resource's r...

CVE-2026-114214

An incorrect authorization vulnerability exists in ash: from version 3.24.0 before 3.37.1 . The flaw occurs in the lateral_join?/4 function within lib/ash/actions/read/relationships.ex. When loading a has_many relationship with a through: declaration and a limit of 1, or an unsorted has_one throu...

CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone through...

EEF-CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Summary Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone...

EUVD-2026-109567

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a hasmany relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted hasone through...

PT-2026-123117

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has one through...