CVE-2026-82747
Received Received - Intake

Incorrect Authorization in Ash Framework Allows Unauthorized Record Access

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible. This issue affects ash: from 3.4.44 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82747
EUVD
EUVD-2026-68966

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 3.4.44 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in the Ash framework where records denied by a runtime read policy are incorrectly returned as authorized. It occurs in the Ash.Policy.Authorizer module when a resource uses an access_type :runtime read policy. The authorizer fails to properly handle records with impossible policy scenarios, returning them instead of forbidding access. The flaw exists in versions 3.4.44 to 3.32.2 of ash.

Detection Guidance

To detect this vulnerability, check if your Ash framework version falls within the affected range (3.4.44 to 3.32.2). Inspect the Ash.Policy.Authorizer module for incorrect handling of runtime read policies. Verify if records denied by runtime policies are incorrectly returned as authorized.

Impact Analysis

This vulnerability allows any actor to access records that should be restricted by runtime read policies. It can lead to unauthorized data exposure, as records denied by access controls are still returned. The impact includes potential leakage of sensitive information protected by these policies.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by allowing unauthorized access to sensitive data. It undermines access control mechanisms required by these standards, potentially resulting in data breaches and regulatory penalties.

Mitigation Strategies

Upgrade the Ash framework to version 3.32.2 or later to apply the patch. Review and update runtime read policies to ensure proper authorization checks. Test the updated system to confirm that denied records are no longer returned.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart