Incorrect Authorization Risk in Ash GraphQL by Ash Project

CVE-2026-80223

What is CVE-2026-80223?

An incorrect authorization vulnerability exists in Ash GraphQL, allowing an authenticated user from one tenant to access records from another tenant through GraphQL subscriptions. The subscription resolver improperly evaluates notification payloads, leading to unauthorized inter-tenant data access. This issue arises because the policy filter used for authorization does not correctly incorporate tenant context during evaluation, thus permitting unauthorized notifications to be sent. Specifically, the notification's single entry lacks tenant restrictions, while batch evaluation only checks the primary entry, potentially exposing sensitive data to unintended users.

References