5.9

CVE-2026-82749

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved.

Loading a relationship whose filter references parent(...) resolves that expression against the parent record. resolve_parent_in_filter/3 (lib/ash/actions/read/relationships.ex) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to nil rather than failing. A scoping predicate such as org_id == parent(org_id) then becomes an IS NULL match, and a guard like is_nil(parent(org_id)) or org_id == parent(org_id) activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a parent(...) reference cannot be resolved, instead of defaulting to nil.

This issue affects ash: from 3.13.2 before 3.32.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerash-project
≫
Produkt ash
Default Statusunaffected
Version 3.13.2
Version < 3.32.2
Status affected
Herstellerash-project
≫
Produkt ash
Default Statusunaffected
Version 0ddff26e6e6bc6d182e1af2f98b431575e5b4179
Version < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.02
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
6b3ad84c-e1a6-4bf7-a703-f496b71e49db 5.9 0 0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/ash-project/ash/security/advisories/GHSA-j8fx-ff37-4j9c
https://cna.erlef.org/cves/CVE-2026-82749.html
https://osv.dev/vulnerability/EEF-CVE-2026-82749
https://github.com/ash-project/ash/commit/e52dad2c39a35f6f043f7324d26e4f4e2551dfd2