Incorrect Authorization Vulnerability in ash_sql by Ash Project

CVE-2026-81316

What is CVE-2026-81316?

An incorrect authorization vulnerability in ash_sql allows attackers to access aggregate data that should be restricted by tenant or user-specific filters. This oversight may enable unauthorized users to receive computed values, such as counts or sums, across different authorization boundaries. The issue stems from the way aggregate queries are handled: if two aggregates share a name but differ in their filters, the system may treat them as identical, leading to the potential for data leakage. Properly managing filter conditions is crucial to prevent this unauthorized access.

References