AIKIDO-2026-590371
ash is vulnerable to Incorrect Authorization
60
CVE Score
Medium
Incorrect Authorization
TL;DR
Ash field policies replace a forbidden field referenced in a filter with nil, so a filter cannot be used as a yes/no oracle for a value the actor may not see. Replacement only matched Ash.Resource.Attribute, Ash.Resource.Aggregate, and Ash.Resource.Calculation structs, so a filter reference that used Ash.Query.Calculation or Ash.Query.Aggregate skipped replacement and used the real value. An actor whose field policy forbids a calculation or aggregate could still filter on it and recover the hidden value by probing which rows match, including through filter arguments in GraphQL or JSON:API extensions. The fix uses the same field policy nil replacement for calculation and aggregate filter references as for attributes.
How do I fix this?
Upgrade the ash library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you define field policies that forbid a calculation or aggregate that remains filterable.
Package
Versions
2.11.0 - 3.33.3
Fixed in 3.33.4Background info
ash is vulnerable to Incorrect Authorization in versions 2.11.0 - 3.33.3.
Links
Fix Commits
github.com/ash-project/ash/commit/0b6d93c7c4637280b46ae66ea1d2eaf013701238github.com/ash-project/ash/commit/b3d4503241f3deacb5ceb955e10a4fa927da0f67
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.