Read the docs
TI-2026-57066 Aliases CVE-2026-82748

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Priority MEDIUM 44CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against. Ash.Actions.Aggregate groups aggregates by their {authorize?, read_action} and authorizes each group under that read action, but when building the data query it selected the action as opts[:action] || read_action || <primary read> (lib/ash/actions/aggregate.ex). When a caller passed an :action option, the aggregate query ran under that action while authorization had been computed for the group's own read_action. If the run action's read policies are more permissive than the authorized one, the aggregate (a count or sum) is computed over records the authorized action's policies would have excluded, disclosing information about data the actor cannot read. The fix runs the aggregate under the same read_action it is authorized against. This issue affects ash: from 3.5.13 before 3.32.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed ash (ash-project): 3.32.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ash-projectash3.5.13 to before 3.32.23.32.2Patch availableCNA
  • ash Vendorash-project Affected 3.5.13 to before 3.32.2 Fixed in 3.32.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash (ash-project) Fixed in 3.32.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ash-project ash 3.32.2

    16 records Highest priority Priority MEDIUM 15 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-57067 Incorrect authorization in ash-project ashPriority MEDIUM 60
    • TI-2026-57065 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorPriority MEDIUM 60
    • TI-2026-57064 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsPriority MEDIUM 60
    Show all 16 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82748

References

Patch 1

Advisory 1

Other 2

  • TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
  • TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
  • TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
  • TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
  • TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences