CVE-2026-77454
Received Received - Intake

Incorrect Authorization in Ash SQL Framework

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit (or from_many?) and a parent(...)-referencing filter or sort. AshSql.Join.related_query/3 skips the caller-supplied exists predicate for such relationships and delegates it to limit_from_many/5. When the relationship's own filter or sort references parent(...), limit_from_many/5 takes a branch that drops both the limit and the predicate, emitting a bare correlated EXISTS with no predicate. The check then matches any record that has any related row. Most severely, when the expression backs a policy (for example authorize_if expr(exists(memberships, user_id == ^actor(:id)))), the actor-scoping condition disappears and the policy passes for any actor with any related row. This issue affects ash_sql: from 0.4.1 before 0.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-77454
EUVD
EUVD-2026-68198

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_sql to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in the ash-project ash_sql library. It occurs when a caller uses an exists/2 predicate over a relationship that has both a limit and a filter or sort referencing parent(...). The exists predicate is silently dropped, allowing the caller to bypass scoping or authorization filters. This happens because the system skips the filter when the relationship has a limit and a parent-referencing filter, resulting in a bare correlated EXISTS with no predicate. Any record with a related row will match, even if it should be restricted.

Detection Guidance

This vulnerability is specific to the ash_sql library and cannot be detected via general network or system commands. Instead, check if your application uses ash_sql versions between 0.4.1 and 0.7.1. Inspect dependency files (e.g., mix.exs for Elixir) for the ash_sql version. If vulnerable, upgrade to version 0.7.1 or later.

Impact Analysis

The vulnerability allows unauthorized access to data by bypassing authorization filters. For example, if an application uses exists/2 in a policy like authorize_if expr(exists(memberships, user_id == ^actor(:id))), any actor with a related row could pass the policy, even if no matching row exists. This could lead to data leaks or unauthorized actions. The impact is higher when the vulnerable code is used in security-critical contexts.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. Bypassing authorization filters may result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade ash_sql to version 0.7.1 or later. If upgrading is not possible, review all uses of exists/2 predicates on relationships with limits and parent() filters. Remove or replace such relationships until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77454. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart