Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path calls Ash.can/3 with run_queries?: false, which evaluates the read policy filter against the in-memory record via Ash.Expr.eval/2 and never issues a query. Ash applies multitenancy at query-build and data-layer-prefix time, not inside query.filter, so the evaluated policy carries no tenant condition and a tenant-B notification routed to a tenant-A subscriber is emitted whenever the policy filter is true. The single-notification clause has no tenant guard at all, and the batched clause checks only the head of the notification list, so non-head entries authorize purely in memory. A tenant-scoped read is reached only when filter evaluation fails. This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ash-project | ash_graphql | 1.4.0 to before 1.11.0 | 1.11.0 | Patch available | CNA |
- ash_graphql Vendorash-project Affected 1.4.0 to before 1.11.0 Fixed in 1.11.0 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA ash_graphql (ash-project) Fixed in 1.11.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
ash-project ash_graphql 1.11.0
6 records Highest priority Priority HIGH 3 HIGH, 3 MEDIUM
Other records, highest priority first
- TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of servicePriority HIGH 77
- TI-2026-56295 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segmentPriority HIGH 70
- TI-2026-54700 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field namesPriority HIGH 70
Timeline
- 2026-10-02 Threatist record created from CVE-2026-80223
References
More ash-project vulnerabilities
- TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
- TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
- TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
- TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
- TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
- TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences