AIKIDO-2026-353851
ash is vulnerable to Incorrect Authorization
60
Medium Risk
This Affects:
ashTL;DR
ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash is vulnerable to Incorrect Authorization in versions 2.6.0 - 3.34.5.
How to fix this
Upgrade the ash library to the patch version.
Links
Fix Commits
github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37cgithub.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.