CVE-2026-114214 in Ash
Summary
by MITRE • 10/25/2026
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.
This issue affects ash: from 3.24.0 before 3.37.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in the ash-project ash framework represents a critical failure in authorization logic within its relational data loading mechanisms, specifically affecting versions ranging from 3.24.0 up to but not including 3.37.1. This flaw stems from an incorrect implementation of how through relationships are resolved when specific query constraints such as limits or offsets are applied. In typical database operations involving has_many associations with a through relationship, the system is expected to maintain strict referential integrity between the source record and its related destination records. However, under certain conditions where a limit of one is imposed on an unsorted has_one through relationship or when loading a single record from a has_many through association, the internal function lateral_join?/4 in lib/ash/actions/read/relationships.ex selects an execution path that bypasses the necessary filtering logic. This results in the retrieval of destination records without any conditional linkage to the original source entity, effectively decoupling the data access from its intended contextual boundaries.
From a technical perspective, this defect allows for unauthorized enumeration and reading of sensitive information by exploiting the pagination features inherent in GraphQL interfaces such as AshGraphql. When an attacker issues a query that requests related records with specific offset parameters, the system fails to apply the appropriate join conditions that would restrict results to only those associated with the authenticated user or source context. Instead, it returns arbitrary destination records based on their sort order or database row position. Although the framework does execute the destination record's individual policies during this process, these checks are insufficient because they do not account for the relationship-based access controls defined at the association level. Consequently, a client can traverse through relationships to access data that should remain inaccessible unless accessed via the proper relational path, thereby bypassing granular authorization rules designed to restrict such cross-referential access.
The operational impact of this vulnerability is significant, particularly in applications relying on strict role-based or attribute-based access control models where relationship context dictates visibility. An attacker with valid credentials can exploit this flaw to enumerate and extract data belonging to other users or entities that are not directly related to their own profile but exist within the same database schema. This capability undermines the principle of least privilege by allowing lateral movement across unrelated records, potentially exposing personally identifiable information, confidential business data, or proprietary assets. The ability to paginate through these incorrectly linked records means that an attacker can systematically harvest large volumes of unauthorized data without triggering typical anomaly detection systems associated with bulk direct access attempts.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key, as it involves the manipulation of relationship keys to bypass intended restrictions. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1078 Valid Accounts combined with data exfiltration patterns seen in lateral movement scenarios where an attacker leverages legitimate access paths to discover and extract unauthorized information. The core issue lies not in authentication but in the failure to enforce contextual authorization constraints during complex query execution.
To mitigate this vulnerability, organizations must immediately upgrade their ash-project dependencies to version 3.37.1 or later, where the lateral_join?/4 function has been corrected to ensure that relationship filters are always applied regardless of limit or offset parameters. Until an update is deployed, administrators should consider implementing additional application-level checks to validate that returned records maintain a valid foreign key connection to the source entity before presenting them to end users. Furthermore, reviewing GraphQL schema definitions to minimize exposure of deeply nested through relationships can reduce the attack surface. Regular security audits focusing on relationship-based access controls and rigorous testing of pagination logic in data retrieval endpoints are essential practices to prevent similar authorization bypasses in future development cycles.