Ash-project Ash up to 3.32.1 Policy Authorizer authorizer.ex check_result improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Ash-project Ash up to 3.32.1. This vulnerability affects the function check_result of the file lib/ash/policy/authorizer/authorizer.ex of the component Policy Authorizer. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-82747. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Ash-project Ash up to 3.32.1. Affected by this issue is the function check_result of the file lib/ash/policy/authorizer/authorizer.ex of the component Policy Authorizer. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 (lib/ash/policy/authorizer/authorizer.ex) by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record ({[record | data], authorizer, any_forbidden?}) and returned it as authorized. As a result, records the runtime read policy denies are returned to any actor. The fix forbids a record whose scenarios are all impossible. This issue affects ash: from 3.4.44 before 3.32.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-82747 since 08/31/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 3.32.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• Ash-project

Name

• Ash

Version

• 3.32.0
• 3.32.1

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion