Data Query Logic Vulnerability in Ash Project by Ash-Project

CVE-2026-70395

What is CVE-2026-70395?

A vulnerability in the Ash Project enables attackers to manipulate data query logic, allowing them to forge relationships to records without proper authorization. When the 'manage_relationship' function is utilized with 'on_lookup: :relate' in a 'belongs_to' relationship, an attacker can submit a nested map instead of a scalar value. This misinterpretation allows for a broader query that can match unintended records, exposing sensitive data linked to the lookup value. The lack of cast to the attribute type and the omission of Ash.Query.limit(1) further complicate the security posture, potentially allowing an attacker to deduce hidden values without breaching authorization policies.

References