ash_graphql EUVD-2026-68287

Exploitation requires three concurrent conditions: (1) the target application uses ash_graphql 1.4.0-1.10.x with multitenancy enabled on at least one Ash resource, (2) that resource exposes a GraphQL subscription endpoint, and (3) the attacker holds a valid authenticated session in any tenant of that application (PR:L). Exploitation is limited to cross-tenant data leakage via the subscription channel - read-only confidentiality impact - and does not extend to mutation or availability. Single-tenant deployments are not affected because the tenant mismatch condition never arises. The vulnerability does not require elevated privileges beyond a normal subscriber role, nor does it require any non-default configuration beyond multitenancy and subscriptions both being active, which is a standard production setup for this library.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H reflects the real-world risk well: network-accessible, low complexity, requires only a valid authenticated session, and results in high confidentiality loss. Exploitation is limited to deployments that both use multi-tenancy and expose GraphQL subscriptions, which is not universal among ash_graphql users but is the primary design target of the library. No CISA KEV listing and no public POC code have been identified, reducing the urgency somewhat for non-internet-exposed or single-tenant deployments. The CVSS does not overstate the threat - the confidentiality impact is genuine and the attack complexity is low for any authenticated user. The absence of integrity or availability impact is accurate: the flaw is purely a data-leak side channel. The key limiting factor is that ash_graphql itself is niche, reducing the aggregate exposed population.

An attacker with a valid account in tenant A of a multi-tenant SaaS application built on ash_graphql creates a GraphQL subscription for a resource type that also exists in tenant B. When a tenant B record matching the resource type is created or updated, the Absinthe subscription pub-sub routes the notification to all matching subscribers; the in-memory fast-path authorization in the resolver evaluates as permitted because the policy filter contains no tenant predicate, and the tenant B record is emitted to the tenant A subscriber's WebSocket connection. No public exploit code has been identified for this vulnerability.