EUVD-2026-54939Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector because client-submitted API values trigger the flaw; AC:H because on_lookup: :relate is a non-default developer configuration; C:L and I:L reflect oracle-based secret recovery and relationship forgery with no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.
When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.
This issue affects ash: from 1.52.0-rc.11 before 3.31.1.
AnalysisAI
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow an attacker to forge a belongs_to relationship to a record whose identifier they cannot directly name, and to systematically recover secret lookup values via a comparison oracle. The root cause is a two-part failure in the managed_relationship on_lookup: :relate code path: client-supplied values reach Ash.Query.filter/2 without type-casting, so a nested map is interpreted as a filter predicate rather than a literal scalar, and the missing Ash.Query.limit(1) call lets Ash.read_one/2 distinguish zero, one, and multiple matches - converting boolean filter predicates into an oracle. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Ash's manage_relationship feature configured with on_lookup: :relate on a belongs_to association - this is a non-default, application-developer-chosen option and not present in every Ash deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 2.1 reflects genuinely limited real-world impact: confidentiality and integrity impacts are both Low, availability is None, and there is no subsequent-system scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker interacting with a Phoenix or Plug application that exposes a create or update action using manage_relationship with on_lookup: :relate on a belongs_to field submits a nested map - for example, %{gte: "a"} - instead of a plain identifier string. Because the value is not cast to the attribute's declared type, Ash interprets it as a filter predicate against the destination resource; the three-outcome response from Ash.read_one/2 (no match, one match, multiple matches) then functions as a comparison oracle. … |
| Remediation | The primary fix is to upgrade ash to version 3.31.1 or later, which introduces type-casting via Ash.Filter.get_filter/2 before lookup values reach Ash.Query.filter/2 and adds Ash.Query.limit(1) to eliminate the oracle signal; the upstream patch commit is 09f42593035bceb0f6153dd7ee45cc49d108300a (https://github.com/ash-project/ash/commit/09f42593035bceb0f6153dd7ee45cc49d108300a). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in the ash crate before 0.33.1 for Rust. Rated critical severity (CVSS 9.8), this vulnerability
Private argument injection in the Ash Elixir framework (versions 3.0.0 through 3.29.2) allows end users to set action ar
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running version
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today