AIKIDO-2026-185251
ash_graphql is vulnerable to Improper Authorization
23
Low Risk
This Affects:
ash_graphqlTL;DR
In AshGraphql.Subscription.Batcher, the do_send/5 function applies the should_send?/1 authorization filter only to the first notification in each batch. Subsequent batched notifications are re-published as already-resolved results without the forbidden/not-found filtering. Subscribers can therefore receive payloads for records they are not authorized to see, revealing record existence and change timing. The fix applies the authorization filter to every notification in a batch.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use GraphQL subscriptions.
Background info
ash_graphql is vulnerable to Improper Authorization in versions 1.4.0 - 1.10.1.
How to fix this
Upgrade the ash_graphql library to the patch version.
Links
Other
github.com/ash-project/ash_graphql/blob/v1.11.0/CHANGELOG.md#v1110-2026-08-30
cna.erlef.org/cves/CVE-2026-81643.htmlosv.dev/vulnerability/EEF-CVE-2026-81643
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.