Incorrect Authorization Vulnerability in Ash-Project's GraphQL Subscription

CVE-2026-81643

What is CVE-2026-81643?

The vulnerability in Ash-Project's GraphQL subscription mechanism allows unauthorized users to receive payloads for records they should not have access to. It occurs due to improper filtering of notifications within the batching process, where only certain errors are discarded, leading to a potential information leak of sensitive data. Specifically, while the initial notification of a batch is validated correctly, subsequent notifications can bypass this check, resulting in unauthorized data exposure. The fix addresses this issue by applying stringent checks across the entire batch, thereby enhancing the security and integrity of data being published.

References