Incorrect Authorization Vulnerability in Ash Project
CVE-2026-114214

6MEDIUM

Key Information:

Vendor: Ash-project
Status: Ash
Vendor: CVE Published:; 25 October 2026

🔔 Create Ash-project Vulnerability Alert

What is CVE-2026-114214?

An incorrect authorization vulnerability exists in Ash Project, allowing unauthorized clients to read unrestricted destination records through a 'through' relationship. When a has_many relationship defined with 'through' is loaded for a single record with a limit of 1, the relationship fails to enforce the necessary filters that would link the destination records to their source. As a result, clients can enumerate sensitive destination records that should only be accessible through specific policy restrictions. This issue impacts Ash versions from 3.24.0 to before 3.37.1.

Affected Version(s)

ash 3.24.0 < 3.37.1

ash 24f41e23dcbd9d07cde270a8141490e8f79251f5

References

https://github.com/ash-project/ash/security/advisories/GH...

vendor-advisoryrelated

https://cna.erlef.org/cves/CVE-2026-114214.html

https://osv.dev/vulnerability/EEF-CVE-2026-114214

CVSS V4

Score:

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 25, 2026
Vulnerability Reserved
Oct 25, 2026

Credit

Will Townsend

Zach Daniel / Ash Project

CVE-2026-114214 Data

JSON