CVE-2025-48044
HIGH
GHSA-pcxq-fjp3-r752
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionNVD
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2.
This issue affects ash: from pkg:hex/[email protected] before pkg:hex/[email protected], from 3.6.3 before 3.7.1, from 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d.
AnalysisAI
Authentication bypass in Ash Framework (Elixir) versions 3.6.3 through 3.7.0 allows low-privileged authenticated attackers to bypass authorization policies and gain unauthorized access to high-confidentiality and high-integrity resources. The flaw resides in the policy expression evaluation logic (lib/ash/policy/policy.ex), enabling attackers to circumvent intended access controls. Publicly available exploit code exists (GitHub commit 8b83efa225f657bfc3656ad8ee8485f9b2de923d references the fix), and with CVSS 8.6 (CVSS 4.0) featuring low attack complexity and network attack vector, this presents significant risk to Elixir applications using vulnerable Ash versions. EPSS data not provided; no CISA KEV status confirmed at time of analysis.
Technical ContextAI
Ash is an Elixir framework for building declarative, resource-oriented applications with integrated authorization policies. The vulnerability stems from CWE-863 (Incorrect Authorization), specifically in the 'Elixir.Ash.Policy.Policy':expression/2 routine within lib/ash/policy/policy.ex. This code handles policy expression evaluation to enforce access control decisions. The flaw allows authenticated users to manipulate or bypass these policy expressions, subverting the intended authorization logic. Affected package identifier is pkg:hex/ash, targeting the Elixir ecosystem's Hex package manager. The vulnerability appears between commit 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 (vulnerable) and fix commit 8b83efa225f657bfc3656ad8ee8485f9b2de923d. This is characteristic of logic errors in declarative policy engines where expression parsing or evaluation can be exploited to construct authorization checks that always succeed or skip critical validation steps.
Affected ProductsAI
The vulnerability affects Ash Framework for Elixir, distributed via Hex package manager (pkg:hex/ash). Specifically impacted are versions 3.6.3 through 3.7.0 inclusive, corresponding to Git commits from 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 up to but not including fix commit 8b83efa225f657bfc3656ad8ee8485f9b2de923d. Applications built with Ash Framework in this version range that rely on policy-based authorization (lib/ash/policy/policy.ex) are vulnerable to authentication bypass. The vendor advisory is available at GitHub Security Advisory GHSA-pcxq-fjp3-r752 (https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752) and documented in the Erlang Ecosystem Foundation CVE database at https://cna.erlef.org/cves/CVE-2025-48044.html. The vulnerability is tracked in OSV database as EEF-CVE-2025-48044 (https://osv.dev/vulnerability/EEF-CVE-2025-48044).
RemediationAI
Immediately upgrade to Ash Framework version 3.7.1 or later, which includes the authorization bypass fix committed in 8b83efa225f657bfc3656ad8ee8485f9b2de923d. For Elixir projects using Mix, update mix.exs dependency specification to {:ash, "~> 3.7.1"} and run mix deps.update ash followed by thorough testing of authorization policies. Organizations unable to upgrade immediately should conduct urgent security review of all policy expressions in lib/ash/policy/ implementations, audit access logs for suspicious authorization patterns, and consider implementing additional perimeter controls or reducing privileges for authenticated users until patching is complete. Review the detailed fix at https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d to understand the specific expression evaluation changes. Consult the official security advisory at https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752 for vendor-specific guidance and any additional workarounds. No effective workaround exists beyond upgrading, as the flaw is in core authorization logic.
Share
External POC / Exploit Code
Leaving vuln.today