CVE-2026-82748
Received Received - Intake

Incorrect Authorization in Ash Framework Aggregate Actions

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against. Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against. This issue affects ash: from 3.5.13 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82748
EUVD
EUVD-2026-68952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 3.5.13 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass in the Ash framework where aggregates are authorized under one read action but executed under another. When a caller provides an action parameter, the system authorizes the query against the read action but runs the aggregate using the provided action. If the provided action has less restrictive policies, it may include data excluded by the authorized read action's filters, leading to unauthorized data exposure.

Impact Analysis

This vulnerability could allow attackers with local access to view data they are not authorized to see. For example, an HTTP reporting endpoint configured to count records with a restricted read action might return a count that includes private records excluded by the read action's filter. The impact is limited as it requires local access and does not affect system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements such as GDPR's data protection principles or HIPAA's access controls. Organizations using affected Ash framework versions should apply the patch to ensure proper authorization and maintain compliance with relevant standards.

Mitigation Strategies

Update the Ash framework to version 3.32.2 or later to apply the fix that ensures aggregates run under the same read action they are authorized against.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart