CVE-2026-80223
Received Received - Intake

Incorrect Authorization in ash_graphql via GraphQL Subscriptions

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with run_queries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, so the evaluated policy carries no tenant condition and a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter is true. The single-notification clause has no tenant guard at all, and the batched clause checks only the head of the notification list, so non-head entries authorize purely in memory. A tenant-scoped read is reached only when filter evaluation fails. This issue affects ash_graphql: from 1.4.0 before 1.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-31
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-80223
EUVD
EUVD-2026-68287

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ash-project ash_graphql to 1.11.0 (exc)
ash-project ash_graphql 1.11.0
ash-project ash_graphql From 1.4.0 (inc) to 1.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-80223 is a high-severity vulnerability in the AshGraphql library affecting versions 1.4.0 to 1.10.1. It allows authenticated subscribers in one tenant to receive records belonging to another tenant through GraphQL subscriptions. The issue occurs because the subscription resolver authorizes notification payloads in memory without enforcing tenant-scoped read policies, bypassing multitenancy controls.

Detection Guidance

To detect this vulnerability, check if your ash_graphql version is between 1.4.0 and 1.10.1. Run: mix deps | grep ash_graphql. If the version falls in this range, the system is vulnerable. Inspect GraphQL subscription logs for unexpected tenant data access patterns or cross-tenant record deliveries.

Impact Analysis

This vulnerability enables authenticated attackers to access unauthorized data by exploiting the batching mechanism in GraphQL subscriptions. Victims' records in different tenants can be delivered to an attacker's subscription, leading to cross-tenant information disclosure and potential confidentiality breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for data isolation and confidentiality in multi-tenant systems. It could lead to unauthorized access to sensitive data, triggering violations of GDPR's data protection principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade ash_graphql to version 1.11.0 or later immediately. Update dependencies using: mix deps.update ash_graphql. Review and enforce tenant isolation in GraphQL subscriptions. Monitor subscription logs for unauthorized data access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart