CVE-2026-114214
Received Received - Intake

Incorrect Authorization in Ash Framework via Through Relationship

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship. This issue affects ash: from 3.24.0 before 3.37.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-114214
EUVD
EUVD-2026-109567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash 3.24.0
ash-project ash 24f41e23dcbd9d07cde270a8141490e8f79251f5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in the ash-project ash framework affecting versions 3.24.0 to 3.37.0. It occurs when a through relationship is loaded with a limit of 1 for a single record. The system fails to properly filter destination records linked to the source, returning unrelated records instead. The lateral_join?/4 function in lib/ash/actions/read/relationships.ex does not apply correct filters, allowing access to records that should only be reachable through the intended relationship path.

Detection Guidance

To detect this vulnerability, check if your ash framework version is between 3.24.0 and 3.37.0. Inspect code using through relationships with limit: 1 or unsorted has_one through relationships. Look for lateral_join?/4 usage in lib/ash/actions/read/relationships.ex.

Impact Analysis

An attacker could exploit this to enumerate destination records that should be restricted. By paging through fields with limit and offset parameters (e.g., in AshGraphql), they can access unauthorized data if the destination resource's policies are permissive or depend on the relationship. The attack requires low privileges, no user interaction, and has network access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to improper access controls, potentially exposing sensitive personal or health information to unauthorized parties.

Mitigation Strategies

Upgrade ash to version 3.37.1 or later immediately. Review all through relationships with limit: 1 or unsorted has_one through relationships for potential exposure. Apply strict access controls to destination resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart