ash-project ash up to 3.34.5 Aggregate aggregate.ex Ash.Actions.Aggregate.run improper authorization

Summaryinfo

A vulnerability was found in ash-project ash up to 3.34.5. It has been declared as problematic. This affects the function Ash.Actions.Aggregate.run of the file lib/ash/actions/aggregate.ex of the component Aggregate. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-101028. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in ash-project ash up to 3.34.5. It has been rated as problematic. Affected by this issue is the function Ash.Actions.Aggregate.run of the file lib/ash/actions/aggregate.ex of the component Aggregate. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected. This issue affects ash: from 2.6.0 before 3.34.6.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-101028 since 10/08/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 3.34.6 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash

Version

• 3.34.0
• 3.34.1
• 3.34.2
• 3.34.3
• 3.34.4
• 3.34.5

Website

• Product: https://github.com/ash-project/ash/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion