EUVD-2026-68953Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because Ash backs web applications reachable over the network; AC:H because exploitation requires the specific co-occurrence of a parent() scoping filter and an unselected parent field; no confidentiality scope change and no integrity or availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.
Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.
This issue affects ash: from 3.13.2 before 3.32.2.
AnalysisAI
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship scoping filters that reference parent() expressions to silently widen when the parent field cannot be resolved. The function resolve_parent_in_filter/3 defaulted the unresolvable expression to nil rather than failing, converting a guard such as org_id == parent(org_id) into an org_id IS NULL match, or activating the unrestricted branch of is_nil(parent(org_id)) or org_id == parent(org_id), thereby returning records the scope was designed to exclude. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to hold simultaneously: (1) the application must define an Ash relationship whose filter uses a parent() expression for access scoping, such as org_id == parent(org_id) or is_nil(parent(org_id)) or org_id == parent(org_id); (2) the referenced parent field (e.g., org_id) must not be selected on the source query at the time the relationship is loaded - this may occur if the application allows callers to specify sparse field sets or if internal query builders omit the field; and (3) the caller must be able to trigger loading of the affected relationship. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score is 5.9 (Medium) with vector AV:L/AC:L/AT:P/PR:N/UI:N/VC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash to version 3.32.2 or later, which is the vendor-released patch per advisory GHSA-j8fx-ff37-4j9c; the fix commit is e52dad2c39a35f6f043f7324d26e4f4e2551dfd2 at https://github.com/ash-project/ash/commit/e52dad2c39a35f6f043f7324d26e4f4e2551dfd2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor wh
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications th
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elix
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create ac
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to a
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify rec
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today