Authorization Flaw in Ash Project Affects User Data Privacy

CVE-2026-101028

What is CVE-2026-101028?

An Incorrect Authorization vulnerability exists in the Ash Project, which can allow unauthorized actors to infer sensitive data from records they do not have permission to access. This vulnerability arises primarily due to the Ash.Actions.Aggregate.run/4 method, which applies only the read policy of the root resource but not the corresponding policies of related resources. As a result, attackers can craft queries that utilize functions like Ash.count/2 or Ash.exists/2, potentially recovering sensitive information about hidden related records through aggregate queries. Users of Ash versions ranging from 2.6.0 to before 3.34.6 are encouraged to apply available patches to mitigate this risk.

References