CVE-2026-82730 in ash_typescript
Summary
by MITRE • 09/01/2026
Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied.
When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value because embedded resources must remain writable, and hides it from Inspect rather than removing it. AshTypescript.Rpc.ResultProcessor strips these markers to nil on its template-driven paths, but normalize_primitive/1 in lib/ash_typescript/rpc/result_processor.ex had no such clause, so a marker fell through to the generic struct branch which calls Map.from_struct/1 and serializes every key, original_value included. The denied value is returned to the caller inside the marker that represents its own denial.
The simplest trigger is an action returning an embedded resource as a map, which routes through normalize_resource_struct/2 with an empty template. normalize_value_for_json/1 is a public, unguarded entry point to the same path.
This issue affects ash_typescript: from 0.11.0 before 0.18.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in the ash_typescript library represents a critical failure in authorization enforcement mechanisms within Ash Framework applications that utilize TypeScript RPC integration. This flaw allows an unauthorized remote procedure call (RPC) caller to bypass field-level access policies and retrieve sensitive attribute values that were explicitly denied by the application's security configuration. The root cause lies in how the framework handles forbidden fields during serialization, specifically when embedded resources are returned as maps or processed through specific normalization paths that lack proper filtering logic for denial markers.
In Ash Framework applications, when a field policy denies access to an attribute, the system does not simply remove the data from memory. Instead, it substitutes the value with a special marker struct called %Ash.ForbiddenField{}. This design choice is intentional because embedded resources must remain writable and intact within the application's internal state management, even if their values are restricted for external consumption. To prevent accidental leakage during debugging or logging, these markers hide their contents from standard inspection tools like Inspect. However, this protection relies entirely on subsequent serialization steps correctly identifying and stripping out these forbidden markers before data is sent to the client.
The technical flaw occurs within the lib/ash_typescript/rpc/result_processor.ex module, specifically in the normalize_primitive/1 function. While other parts of the codebase, such as AshTypescript.Rpc.ResultProcessor for template-driven paths, correctly check for ForbiddenField markers and replace them with nil to enforce denial, the generic normalization path does not include this safeguard. When a forbidden field marker falls through to the generic struct branch in normalize_primitive/1, it invokes Map.from_struct/1 on the marker itself. This operation serializes all keys present in the struct, including the original_value key which holds the actual sensitive data that was supposed to be hidden. Consequently, the denied value is returned to the caller inside the serialized representation of the denial marker itself, effectively defeating the authorization check.
The operational impact of this vulnerability is severe for applications relying on ash_typescript for API exposure. An attacker can exploit this by crafting RPC calls that trigger the specific code paths where normalization occurs without template-driven filtering. The simplest trigger involves actions that return embedded resources as maps, which route through normalize_resource_struct/2 with an empty template. Additionally, because normalize_value_for_json/1 serves as a public and unguarded entry point to the same vulnerable path, it provides another vector for exploitation. This means that any API endpoint exposing such data structures is potentially susceptible to information disclosure attacks, allowing attackers to read sensitive user attributes or internal system states that should remain inaccessible based on their role or permissions.
This vulnerability affects versions of ash_typescript from 0.11.0 up to but not including version 0.18.0. Organizations using these affected versions are at risk of unauthorized data access through RPC interfaces. The flaw aligns with CWE-269, Improper Privilege Management, as it involves a failure in enforcing intended restrictions on user actions and resource access. Furthermore, from the perspective of attack patterns, this relates to ATT&CK technique T1078, Valid Accounts, if exploited by authenticated users who have been granted limited permissions but can still extract restricted data due to implementation errors rather than authentication failures.
To mitigate this vulnerability, immediate upgrade to ash_typescript version 0.18.0 or later is required, as the issue has been addressed in subsequent releases. For applications that cannot immediately update dependencies, developers should audit their RPC result processors and normalization logic to ensure that all paths handling struct serialization explicitly check for %Ash.ForbiddenField{} markers and replace them with nil before returning data to clients. Implementing strict input validation and ensuring that no public entry points bypass the standard filtering mechanisms can also help reduce exposure until a patch is applied. Regular security audits of authorization enforcement in embedded resource handling are recommended to prevent similar logic flaws in future development cycles.