ash-project ash up to 3.32.1 Relationships relationships.ex resolve_parent_in_filter improper authorization

Summaryinfo

A vulnerability classified as problematic has been found in ash-project ash up to 3.32.1. Affected by this vulnerability is the function resolve_parent_in_filter of the file lib/ash/actions/read/relationships.ex of the component Relationships. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-82749. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ash-project ash up to 3.32.1. It has been rated as problematic. This issue affects the function resolve_parent_in_filter of the file lib/ash/actions/read/relationships.ex of the component Relationships. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil. This issue affects ash: from 3.13.2 before 3.32.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-82749 since 08/31/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 3.32.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash

Version

• 3.32.0
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion