CVE-2026-81316
Received Received - Intake

Incorrect Authorization in ash_sql Allows Aggregate Data Leak

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.different_queries?/2 reports two aggregate queries as different only when their filter and their sort both differ. Aggregate queries rarely carry a sort, so two aggregates that share a name but carry entirely different filters compare as identical. The colliding aggregate keeps its name and is treated as already computed, and select_aggregates returns the first-registered variant's value. The same name reaches the builder twice with different filters when actor or tenant context is stamped into each aggregate's query, so a narrowly filtered aggregate can be served the value of a previously registered broad one. This issue affects ash_sql: from 0.1.0 before 0.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81316
EUVD
EUVD-2026-68196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_sql From 0.1.0 (inc) to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in the ash_sql library where aggregates with the same name but different filters are incorrectly treated as identical. This allows a caller to receive aggregate values computed over rows that should have been excluded by a more restrictive filter, leading to unauthorized disclosure of counts, sums, or lists across authorization or tenancy boundaries.

Detection Guidance

This vulnerability is specific to the AshSql library and cannot be detected via general network or system commands. Check if your application uses ash_sql versions prior to 0.7.1 by inspecting dependency files like mix.exs or package.json. Look for unauthorized data exposure in aggregate queries by reviewing logs for unexpected values in counts, sums, or lists.

Impact Analysis

An attacker could exploit this to bypass authorization controls and access sensitive aggregate data they are not permitted to see, such as counts or sums of restricted records. This could lead to information disclosure but does not affect system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Upgrade ash_sql to version 0.7.1 or later immediately. Review all aggregate queries in your application to ensure filters are correctly applied. Audit logs for unauthorized data access patterns. If using Elixir, run mix deps.update ash_sql to apply the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart