Ash Framework CVE-2026-114214

Exploitation requires the affected resource to declare a has_many relationship with through: (or an unsorted has_one through: relationship), loaded for a single source record with a caller-controllable limit: 1 and optional offset - for example exposed via AshGraphql relationship field arguments - AND the destination resource's read policies must rely on the relationship (accessing_from) or otherwise be open to the caller. Limiting factors: an authenticated session is required (PR:L), only ash versions 3.24.0 through before 3.37.1 are affected, only through relationships loaded via the limit:1 code path in lateral_join?/4 are vulnerable, and impact is strictly read/confidentiality (no write or integrity effect). Deployments without such a through relationship exposed to caller-controlled paging, or whose destination policies do not depend on accessing_from, are not exploitable.

This is a medium-severity authorization flaw (CVSS 4.0 base 6.0). The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity information-disclosure issue that requires low privileges (PR:L - an authenticated client) and carries an attack requirement (AT:P) reflecting the specific through-relationship configuration and caller-controlled limit:1 path needed to trigger it. Impact is confidentiality-only; there is no integrity or availability effect (VI:N/VA:N). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit identified at time of analysis (references are the vendor advisory and patch commits, not exploit code). The vuln.today decision label is 'this_month', consistent with a real but non-emergency fix priority rather than act_now/emergency. Net read: a legitimate authorization-bypass that an authenticated, API-enabled client can abuse for bounded data enumeration, but it is gated behind a non-default resource/policy configuration and requires an existing authenticated session - so it is a scheduled-remediation item, not a drop-everything issue. Note the signals are internally consistent (no KEV/EPSS conflict), but EPSS is simply absent rather than low.

An authenticated client with access to a GraphQL field backed by a through relationship issues a query such as teachers(limit: 1, offset: n) and increments the offset. Because the destination is read without the filter that links it to the source record, the client pages through and enumerates destination records that policies would otherwise only permit when reached through the proper relationship. No public exploit exists; the scenario is reconstructed from the vendor advisory, and exploitation is network-based with low complexity but requires an authenticated session.