AIKIDO-2026-953190
ash is vulnerable to Incorrect Authorization
21
Low Risk
This Affects:
ashTL;DR
When running an aggregate, authorization can use a caller supplied action option while the aggregate runs under a different read_action. The scoped read action's filters and policies are bypassed, so counts and other aggregates include records the scoped action excludes. Applications that expose such aggregates leak information about restricted data. The fix authorizes aggregates under the same action they run under.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose aggregates configured with both an action and a scoped read_action.
Background info
ash is vulnerable to Incorrect Authorization in versions 3.5.13 - 3.32.1.
How to fix this
Upgrade the ash library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.